{
  "finding_id": "DF-5451",
  "status": "reproduced",
  "verdict": "REPRODUCED on the live guest: nexus_get_resource() (nexus.c:567-568) prints caller kernel-stack addresses (startp/countp) and the kmallocd resource_list_entry heap address via device_printf() on every bus_get_resource() of a direct nexus child. The line reached dmesg AND /var/log/messages (mode 644), both read successfully by an unprivileged uid=1001 user. Fix (delete the debug printf) validated on a rebuilt kernel: line gone, bus_get_resource() still returns correct values.",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "exploit_chain": "Unprivileged local user reads /var/log/messages or runs dmesg -> obtains kernel stack and heap addresses (0xfffff801.../0xfffff800...) whenever any driver queried a nexus childs resource. Value today is limited (no KASLR on these regions in this build) but it is an unconditional, permanently-logged kernel-address disclosure (KASLR-breaking on hardened kernels).",
  "evidence": "run.log: startp 0xfffff801180c7718 countp 0xfffff801180c7720 - got 0xfffff8008dc229d8 present in dmesg and /var/log/messages; unprivileged dmesg | grep -c startp = 1; run.2.log different boot/addresses; fix_run.log: 0 occurrences on patched kernel",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/nexus.c:560-576",
    "sys/kern/subr_bus.c:3391",
    "sys/kern/subr_bus.c:3401",
    "sys/kern/subr_bus.c:3414"
  ],
  "poc_changes": "none material: seed sketch concept kept as a nexus-child KLD performing one bus_get_resource(); added success/return-value print",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cd /root/poc/nxget && make   (KMOD=nxget SRCS=nxget.c device_if.h bus_if.h, bsd.kmod.mk)",
  "run_cmd": "kldload /root/poc/nxget/nxget.ko; sleep 1; dmesg | grep -E nxget|DF-5451; grep startp /var/log/messages; then as unprivileged user: dmesg | grep startp",
  "code_hash": "f603a4ebb8f45f12856cf3c6b83ea329c1bd141824268313400b13a43526ffd9",
  "notes": "Trigger requires a driver to call bus_get_resource on a nexus child (no in-tree runtime caller found: pci/isa/acpi grandchildren dispatch to their own bus methods); the printf is unconditional debug cruft at the nexus boundary.",
  "recommended_fix": "Delete the device_printf() at nexus.c:567-568",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.combined.diff applied in guest /usr/src, nativekernel rebuilt and booted: no startp pointer line in dmesg or /var/log/messages; bus_get_resource() still succeeds with correct values",
  "fix_evidence": "findings/poc/DF-5451/fix_run.log ([messages] count 0 on patched kernel)"
}