# DF-5451 VERDICT — REPRODUCED (kernel pointer disclosure to unprivileged users)

## Finding
`nexus_get_resource()` — sys/platform/pc64/x86_64/nexus.c:560-576 — contains
a leftover debug `device_printf()` at nexus.c:567-568 that prints, for every
`bus_get_resource()` (and `bus_get_resource_start/count`,
sys/kern/subr_bus.c:3391,3401,3414) on a *direct nexus child*:
- `startp`/`countp`: addresses of the caller's output variables — kernel
  stack addresses;
- `got %p`: the kmalloc'd `struct resource_list_entry` — kernel heap address.

## Reproduction (baseline, kernel #0 Jul 2 2026)
KLD `nxget.ko` (nexus child) performs one ordinary `bus_get_resource()`:
```
nxget0: type 3  rid 7  startp 0xfffff801180c7718  countp 0xfffff801180c7720 - got 0xfffff8008dc229d8
```
The line appears in `dmesg` AND `/var/log/messages` (mode 644 on this
system); an unprivileged user (uid=1001) read both:
```
$ dmesg | grep -c startp        -> 1
$ grep -c startp /var/log/messages -> 1
```
Second run on a different boot leaked different addresses
(0xfffff801183a3718 / 0xfffff8008dc22e00) — real per-boot kernel stack and
heap addresses, not constants.

## Impact
Local unprivileged users observe kernel stack and heap pointers. This
system runs without kernel address randomization of these regions, so the
immediate value is limited, but the disclosure is unconditional, logged
permanently, and becomes KASLR-breaking material on hardened kernels; it is
also pure debug cruft with no functional purpose. Trigger requires a driver
to call bus_get_resource on a nexus child (rare in-tree — e.g. no current
caller; KLD/out-of-tree and future in-tree callers hit it). Severity Low.

## Fix validation (kernel #1 Oct 5 17:59:42)
fix.diff deletes the two printf lines. Patched result (fix_run.log): no
`startp` line in dmesg or /var/log/messages; `bus_get_resource()` still
returns 0 with correct values.

## Kernel refs
sys/platform/pc64/x86_64/nexus.c:560-576 (printf at 567-568)
sys/kern/subr_bus.c:3391, 3401, 3414

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.