{
  "finding_id": "DF-5816",
  "title": "unp_pcblist sysctl exports raw kernel pointers (unpcb/socket/sockaddr/vnode + connection graph) to unprivileged users",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "summary": "net.local.{stream,dgram,seqpacket}.pcblist (CTLFLAG_RD, no privilege gate) hands each unprivileged reader a struct xunpcb per AF_UNIX socket containing xu_unpp, a verbatim bcopy of struct unpcb (unp_socket/unp_conn/unp_addr/unp_vnode/unp_rvnode/unp_fp/list links) and xso_so/so_pcb from sotoxsocket -- a complete kernel heap-object map plus the socket connection graph.",
  "reproduce": {
    "build": "cc -O2 -Wall -o pcblist_ptrleak pcblist_ptrleak.c   (or sh build.sh)",
    "run": "sh run.sh   (as any unprivileged user; runs the PoC 3x)",
    "expected": "LEAK CONFIRMED: all exported pointers kernel-range (>=0xffff000000000000), so_pcb==xu_unpp and xso_so==unp_socket per record, mutual unp_conn==peer.xu_unpp for a socketpair created by the PoC, unp_addr/unp_vnode/unp_rvnode disclosed for a bound dgram"
  },
  "kernel_refs": [
    "sys/kern/uipc_usrreq.c:1475-1495",
    "sys/kern/uipc_usrreq.c:1432-1509",
    "sys/kern/uipc_usrreq.c:1511-1519",
    "sys/sys/unpcb.h:68-85",
    "sys/sys/unpcb.h:111-127",
    "sys/kern/uipc_socket2.c:827-831"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "pcblist_ptrleak.c", "build.sh", "run.sh",
    "build.log", "run.log", "fix_validation.log", "fix_build_excerpt.txt",
    "fix.diff", "env.txt", "manifest.json", "verdict.json"
  ]
}