Summary

cbq_getqstats() declares class_stats_t stats on the stack without zeroing it, then calls get_class_stats() which only partially initializes the struct. The fields stats.handle (4 bytes) and stats.red[3] (up to 144 bytes) are never assigned. copyout() then ships the full ~240-byte struct — including ~148 bytes of raw kernel stack — to userspace.

Root cause

In cbq_getqstats (altq_cbq.c:469-507) the local class_stats_t stats; (line 473) is an uninitialized auto variable. get_class_stats() (altq_cbq.c:191-220) populates many fields (xmit_cnt, drop_cnt, over, borrows, etc.) but:

• Never assigns statsp->handle despite cl->stats_.handle being available (set at altq_cbq.c:383). Functional bug + leak.
• Never assigns statsp->red[3] (3 × struct redstats, 48 bytes each per altq_red.h:50-57) when ALTQ_RED/ALTQ_RIO are not compiled in or the queue is not RED/RIO. Even with RED compiled in and q_is_red() true, red_getstats() fills only &statsp->red[0] — red[1] and red[2] (96 bytes) stay uninitialized.

copyout at line 503 copies sizeof(stats) bytes regardless, leaking the uninitialized fields.

Threat model & preconditions

• Privilege: root (or a process with CAP rights on /dev/pf, which is mode 0600 root:wheel per pf_ioctl.c:3360).
• Impact: ~148 bytes of kernel stack per call — may contain pointers useful for KASLR bypass, stack canaries, or adjacent stack frames. Marginal direct impact because root-only, but a real defense-in-depth defect. The same pattern exists in altq_priq.c, altq_hfsc.c, and altq_fairq.c.

Recommended fix

(1) Zero-initialize stats before get_class_stats():

memset(&stats, 0, sizeof(stats));

(2) Fill statsp->handle from cl->stats_.handle:

statsp->handle = cl->stats_.handle;

References

• sys/net/altq/altq_cbq.c:473 — uninitialized class_stats_t stats.
• sys/net/altq/altq_cbq.c:191-218 — get_class_stats partial fill.
• sys/net/altq/altq_cbq.c:503 — copyout of full struct.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).