# DF-5813 — four more raw-kernel-pointer kprintfs on pagedaemon race-recovery paths

**Finding:** `vm_pageout_page()` and `vm_pageout_scan_cache()` print raw
`vm_page_t` pointers (physmap/`vm_page_array` addresses) plus page state to
the console/msgbuf on race-recovery paths:

- `sys/vm/vm_pageout.c:1340` — `vm_pageout_page: rebusy %p failed(A)` (page
  moved queues / changed object / vnode handle changed across the blocking
  `vget()` window),
- `sys/vm/vm_pageout.c:1350` — `... failed(B)` (page became invalid),
- `sys/vm/vm_pageout.c:1356` — `... failed(C)` (page was cleaned by a
  competing flush during `vget()`),
- `sys/vm/vm_pageout.c:1728` — `WARNING! page race during find/busy: %p
  queue == %d dirty=%02x` (PQ_CACHE page raced between
  `vm_page_list_find()` and `vm_page_busy_try()`).

Sibling of DF-2689 (which covers only the `scan_hold` print at :1932).

## Verification verdict: not_reproduced (race never fired on this guest)

Verified on the guest (DragonFly 6.5-DEVELOPMENT #0, X86_64_GENERIC):

1. All four format strings ARE in the running kernel:
   `strings /boot/kernel/kernel | grep -E 'failed\((A|B|C)\)|page race during find|HOLD->FREE'` → 1/1/1/1.
2. The msgbuf is world-readable by an unprivileged user (`test`/`maxx`
   uid 1001/1002 ran `/sbin/dmesg` successfully) — so *when* the prints
   fire, the pointer is disclosed to any local user.
3. Five adversarial stress rigs (~25 min wall, ~2 GB/s of vnode-page
   churn under sustained pagedaemon pressure) did NOT hit the races:
   - v1: mmap+msync(MS_ASYNC)+madvise churn + ftruncate + 2.3 GB anon hog
   - v2: 6–8 files × writers/syncer(MS_SYNC+MS_INVALIDATE)/cacher + hogs
   - v3: persistent dirty RW maps (writers never clean) + 1.4 GB hog
   - v4: dirty-then-ABANDON cycling (WINATCFLS state machine) + 2.6 GB hog
   - file placement on UFS (/boot) and HAMMER2 (/), hog 500–2700 MB
   During the rigs the pagedaemon was demonstrably active (1862 wakeups,
   1.31 M pages examined, 295 k pages freed by daemon, vnode putpages
   counter +60 k) — but `vm.pageout_lock_miss` stayed 0 (the daemon's
   `vget()` in the laundering branch never even timed out on this
   fast-disk single-tenant guest) and none of the four prints fired.

Conclusion: the disclosure is certain by inspection (the prints are
unconditional on their paths and dmesg is world-readable), but the
guarded interleavings are empirically rare on this hardware; the PoC is
recorded as not_reproduced rather than claimed without a firing.

## Files
- `df5813_leakstress.c` — v4 trigger (final; see header for design notes)
- `build.sh` / `run.sh`
- `run.log` — decisive rig run output (v4, 300 s, markers stayed 0)
- `strings_check.txt` — kernel-binary + dmesg-permission verification
- `verdict.json` — machine verdict