DF-0016 — PoC

leak_kinfo.c — unprivileged disclosure of kernel heap / struct proc pointers via the world-readable kern.proc.* sysctl (kinfo_proc).

The bug

fill_kinfo_proc() / fill_kinfo_lwp() / fill_kinfo_proc_kthread() (sys/kern/kern_kinfo.c:128-129, :272, :301, :321) fill user-visible kinfo_proc / kinfo_lwp fields with raw kernel virtual addresses:

kp->kp_paddr         = (uintptr_t)p;                 /* kern_kinfo.c:128 */
kp->kp_fd            = (uintptr_t)p->p_fd;           /* kern_kinfo.c:129 */
kl->kl_wchan         = (uintptr_t)td_wchan;          /* kern_kinfo.c:272 */
kp->kp_ktaddr        = (uintptr_t)td;                /* kern_kinfo.c:301 */
kp->kp_lwp.kl_wchan  = (uintptr_t)td->td_wchan;      /* kern_kinfo.c:321 */

These are copied out unredacted via sysctl_out_proc (sys/kern/kern_proc.c:1603/1612/1633). sysctl_kern_proc for KERN_PROC_PID only checks PRISON_CHECK (jail), not p_trespass (kern_proc.c:1690), so an unprivileged user reads the kinfo_proc of any pid (including every root daemon) and recovers those addresses — a KASLR-bypass / slab-address primitive.

Build

cc -o leak_kinfo leak_kinfo.c      # or: ./build.sh

Run

As an unprivileged user (e.g. maxx):

./leak_kinfo       # or: ./run.sh

Expected output (bug present — unpatched #0)

== self ==
  pid 850    uid=1001 comm=leak_kinfo
      kp_paddr   = 0xfffff80116e97780  (struct proc slab)
      kp_fd      = 0xfffff80116eceb40  (filedesc slab)
== pid 1 (init) ==
  pid 1      uid=0    comm=init
      kp_paddr   = 0xfffff80089977280  (struct proc slab)
      kp_fd      = 0xfffff8008d2254c0  (filedesc slab)
      kl_wchan   = 0xfffff80089977280  (wait channel)
result: 69 kernel pointers leaked across 23 processes (of 23 total readable)
result: LEAK CONFIRMED (KASLR-defeat / slab-address primitive)    [exit 0]

kp_paddr is the live slab address of the target's struct proc. The tally is taken over every readable process via kern.proc.all, so it is robust across boots (no hardcoded PIDs). On the prior-session boot a .text-range wait channel was also leaked: cron kl_wchan 0xffffffff8130f670 → nm symbol nanowait (exact) — directly revealing the kernel text base.

Expected output (bug fixed — single-fix kernel #1)

== pid 1 (init) ==
  pid 1      uid=0    comm=init
      kp_paddr   = 0x0000000000000000
      kp_fd      = 0x0000000000000000
      kl_wchan   = 0x0000000000000000
      kp_ktaddr  = 0x0000000000000000
result: 0 kernel pointers leaked across 0 processes (of 23 total readable)
result: no kernel pointers observed (fields appear redacted)    [exit 2]

The sysctl access path is unchanged (23 procs still readable), only the kernel addresses are zeroed before copyout. See VERDICT.md for the full before/after fix validation and fix.diff for the verified patch.

DF-0016 — kern.proc.* (kinfo_proc) exports unredacted kernel pointers (KASLR defeat)

Verdict

REPRODUCED + FIX VALIDATED. The world-readable kern.proc.* sysctl returns the full struct kinfo_proc with unredacted kernel virtual addresses in kp_paddr (struct proc slab), kp_fd (filedesc slab), kl_wchan (wait channel) and kp_ktaddr (kernel thread). Confirmed on the unpatched DragonFly master DEV 6.5-DEVELOPMENT #0 (Thu Jul 2 06:02:54 UTC 2026): as unprivileged maxx (uid 1001, not in wheel) 69 kernel pointers leaked across 23 readable processes in a stable, deterministic tally. The standalone fix.diff (zero those 5 fields in sys/kern/kern_kinfo.c before copyout) was applied to /usr/src, built as a single-fix kernel #1, and booted: re-running the same PoC yields 0 leaked pointers (all fields redacted) — the leak is closed with no functional regression (the sysctl still returns all 23 processes; only the kernel addresses are zeroed).

Mechanism (confirmed by source + run)

fill_kinfo_proc (sys/kern/kern_kinfo.c:128-129):

kp->kp_paddr = (uintptr_t)p;          /* struct proc slab address     */
kp->kp_fd    = (uintptr_t)p->p_fd;    /* struct filedesc slab address */

fill_kinfo_lwp (kern_kinfo.c:272): kl->kl_wchan = (uintptr_t)lwp->lwp_thread->td_wchan; fill_kinfo_proc_kthread (kern_kinfo.c:301): kp->kp_ktaddr = (uintptr_t)td; and (kern_kinfo.c:321): kp->kp_lwp.kl_wchan = (uintptr_t)td->td_wchan;

These five (uintptr_t) casts are the only kernel-pointer assignments into struct kinfo_proc/struct kinfo_lwp in kern_kinfo.c (verified by grep -n "uintptr_t"). The fields live in user-visible struct kinfo_proc (sys/sys/kinfo.h:174 kp_paddr, :183 kp_fd, :237 kp_ktaddr, :149 kl_wchan). They are copied out unredacted by sysctl_out_proc (sys/kern/kern_proc.c:1603 fill, :1612/:1633 SYSCTL_OUT(req, &ki, sizeof(ki))).

Reachability: sysctl_kern_proc for KERN_PROC_PID (kern_proc.c:1686-1694) does pfind(name[0]) and only checks PRISON_CHECK(cr1, crcache) (:1690) — no p_trespass. So an unprivileged user reads the kinfo_proc of any pid (not just own). The kern.proc.* nodes are CTLFLAG_RD and sysctl reads are not framework-gated (kern_sysctl.c:1446-1450 gates writes only).

Proof (baseline, unpatched #0)

./leak_kinfo as maxx (uid 1001) enumerates kern.proc.all and counts the kernel-range pointer fields across every readable process (excerpt; full in leak_sample.txt / run.log):

== self ==
  pid 850    uid=1001 comm=leak_kinfo
      kp_paddr   = 0xfffff80116e97780  (struct proc slab)
      kp_fd      = 0xfffff80116eceb40  (filedesc slab)
== pid 1 (init) ==
  pid 1      uid=0    comm=init
      kp_paddr   = 0xfffff80089977280  (struct proc slab)
      kp_fd      = 0xfffff8008d2254c0  (filedesc slab)
      kl_wchan   = 0xfffff80089977280  (wait channel)
result: 69 kernel pointers leaked across 23 processes (of 23 total readable)
result: LEAK CONFIRMED (KASLR-defeat / slab-address primitive)   RUN_EXIT=0

3 baseline runs are identical (69 / 23 procs); root-daemon slab addresses are byte-identical across all 3 (e.g. init kp_paddr 0xfffff80089977280 every time — a real, fixed live kernel object), while the self (leak_kinfo) kp_paddr differs run-to-run because each run is a new process — itself confirming these are live slab allocations, not stack residue. In the prior session a .text-range wait-channel was observed: cron kl_wchan 0xffffffff8130f670 → nearest nm symbol nanowait (exact), directly revealing the kernel text base (KASLR defeat).

Fix validation (Phase 8)

fix.diff (sys/kern/kern_kinfo.c, this folder) zeroes all 5 pointer-cast sites — kp_paddr, kp_fd, kl_wchan (lwp), kp_ktaddr, kp_lwp.kl_wchan (kthread) — before they reach userland. This is complete coverage: grep uintptr_t kern_kinfo.c shows these are the only 5 kernel-address assignments into the copied-out struct.

== pid 1 (init) ==   [patched #1]
      kp_paddr   = 0x0000000000000000     (REDACTED)
      kp_fd      = 0x0000000000000000     (REDACTED)
      kl_wchan   = 0x0000000000000000     (REDACTED)
      kp_ktaddr  = 0x0000000000000000     (REDACTED)
result: 0 kernel pointers leaked across 0 processes (of 23 total readable)
result: no kernel pointers observed (fields appear redacted)   RUN_EXIT=2

before/after: baseline #0 leaked 69 kernel pointers / 23 procs → single-fix #1 leaked 0 / 23 procs. The sysctl access path is unchanged (23-24 processes still readable, PRISON_CHECK still the only gate), so there is no functional regression — only the kernel addresses are redacted. fix_status = fixed.

Impact

Information disclosure to any local unprivileged user: the live slab address of every process's struct proc and struct filedesc, plus wait-channel / kernel-thread addresses (sometimes a .text symbol). A reliable KASLR-bypass and slab-layout primitive. Standalone it is info-disclosure (rated Low), but it is the enabler that escalates the practical severity of any local heap / struct-proc corruption bug (e.g. DF-0013) from DoS to reliable local privilege escalation by defeating KASLR and revealing the slab layout for grooming. This is not a memory-corruption class — there is no further exploit chain to develop (no primitive beyond address disclosure).

PoC changes (this session)

1. Rewrote leak_kinfo.c to enumerate the whole process table via kern.proc.all (KERN_PROC_ALL) instead of hardcoding PIDs (68/285/328/...) that do not survive a vm.sh reset. The tally is now robust across boots: it counts the 4 pointer fields (kp_paddr, kp_fd, kl_wchan, kp_ktaddr) across every readable process, plus keeps the detailed self + pid-1 dump and a 3× stability check on pid 1's kp_paddr. On the unpatched kernel the tally is large and deterministic; on the patched kernel it drops to exactly 0.
2. run.log / leak_sample.txt / env.txt refreshed with the boot-2 (#0/ #1) addresses, before/after contrast, and the patched-kernel sha256.
3. fix.diff unchanged from prior session — re-verified it applies cleanly (4/4 hunks) and fully closes the leak. The index 0000000..1111111 line is a placeholder (fine for patch -p1).

Recommended fix

Matches the finding markdown's proposal (with the libkvm caveat). The authoritative fix.diff in this folder zeroes kp_paddr/kp_fd/ kl_wchan/kp_ktaddr/kp_lwp.kl_wchan in kern_kinfo.c before copyout. For libkvm (/dev/mem//dev/kmem) consumers that need the real addresses (and already require root), the addresses should additionally be gated behind a root-only / /dev/mem-mediated path so unprivileged sysctl readers get zeroes — but the simple zeroing alone closes the unprivileged leak and is what was validated here.