# DF-5786 — kernel pointer disclosure to unprivileged dmesg readers via
# hammer2 debug/error kprintf paths (pass 3; Info — hardening)

No PoC evidence pack: Low/Info hardening finding, verification skipped per
audit contract (status recorded as untested by the orchestrator).

## What

Unconditional `kprintf("%p...")` calls in sys/vfs/hammer2/hammer2_chain.c
disclose kernel heap/object addresses to the console message buffer, which
unprivileged users can read (`dmesg`/`sysctl kern.msgbuf` is world-readable
on this guest — verified as user `maxx` during this session):

* hammer2_chain.c:2266 `kprintf("hammer2: debug REPTRACK %p->%p\n", parent,
  reptrack.chain)` — reachable whenever `hammer2_chain_repparent()`'s
  parent-migration loop cycles (flusher/indirect-maintenance races).
* hammer2_chain.c:2333-2334 `kprintf("hammer2: debug repchange %p %p->%p\n",
  ...)` — same machinery.
* hammer2_chain.c:5460-5471 (hammer2_characterize_failed_chain) — prints
  `chain`, `bdata`, `dio`, `bp` pointers and buffer geometry on media
  check failures (krate-limited to 1/sec); check failures are attacker-
  inducible on a crafted image (mismatched check bytes) or by disk
  corruption.

## Impact

Defeats kernel-address randomization for anyone who can read the message
buffer (on guests/KASLR-less configs low value; on hardened configs it is
the standard KASLR-bypass primitive). Info severity.

## Suggested fix

Drop `%p` from these messages (print keys/tids instead of addresses), or
gate them behind `hammer2_debug` bits like the neighboring
`LOST PARENT RETRY` message (hammer2_chain.c:3966).