DF-5451 run.log — baseline (unpatched kernel)
Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS), QEMU/KVM
Commands (root):   kldload /root/poc/nxget/nxget.ko; dmesg | grep -E "nxget|DF-5451"
Commands (user):   dmesg | grep startp ; grep startp /var/log/messages | tail -1

[root@dfbsd]
nxget0: <nexus get_resource printf PoC> on motherboard
nxget0: type 3  rid 7  startp 0xfffff801180c7718  countp 0xfffff801180c7720 - got 0xfffff8008dc229d8
DF-5451: bus_get_resource returned 0 start=0xe0000000 count=0x1000 (the leaked-pointer line above came from nexus.c:567)

[unprivileged uid=1001 (maxx)]
nxget0: type 3  rid 7  startp 0xfffff801180c7718  countp 0xfffff801180c7720 - got 0xfffff8008dc229d8
Oct  5 17:51:18 dfbsd kernel: nxget0: type 3  rid 7  startp 0xfffff801180c7718  countp 0xfffff801180c7720 - got 0xfffff8008dc229d8

Leaked values:
- startp / countp = 0xfffff801180c7718 / 0xfffff801180c7720 — addresses of
  the caller's stack variables (kernel stack of the attaching thread)
- "got 0xfffff8008dc229d8" — the kmalloc()d struct resource_list_entry
  (kernel heap address in the M_BUS/objcache region)

Both the kernel message buffer (dmesg) and /var/log/messages (mode 644) are
readable by an unprivileged local user; the same line appears in each.

run.2.log: the first run (before guest reset) leaked
startp 0xfffff801183a3718 countp 0xfffff801183a3720 got 0xfffff8008dc22e00.