Cross-reference: Identical pattern to DF-0652 (cbq) and DF-0592 (fairq). All three ALTQ schedulers have the same uninit-stack-leak in their getqstats handler.

Summary

priq_getqstats declares struct priq_classstats stats on the kernel stack without zeroing (line 221). get_class_stats only populates the scalar fields and conditionally red[0]/red[0..2]; the 4-byte compiler padding between qtype and red[0] plus the entire 168-byte red[3] array remain uninitialized for the default Q_DROPTAIL configuration. copyout(&stats, ubuf, sizeof(stats)) at line 251 then leaks ~172 bytes of stale kernel stack to userspace per DIOCGETQSTATS call.

Root cause

altq_priq.c:221: struct priq_classstats stats; on the stack, no memset. get_class_stats (altq_priq.c:609-627) writes scalar fields but: - 4-byte padding at off 52-55 (between qtype and red[0]): never written by anyone. - red[3] (168 bytes, off 56-223): never written for the default Q_DROPTAIL (line 354). Even with Q_RED, red_getstats fills only red[0]; red[1]/red[2] stay uninitialized.

copyout at line 251 copies the full 224 bytes unconditionally.

Threat model & preconditions

• Privilege: root (or /dev/pf-granted; mode 0600 root:wheel).
• Impact: ~172 bytes of kernel stack per call — may contain kernel pointers (KASLR bypass), credential pointers, or other sensitive locals.
• Same one-line fix as DF-0652/DF-0592: memset(&stats, 0, sizeof(stats)).

Recommended fix

--- a/sys/net/altq/altq_priq.c
+++ b/sys/net/altq/altq_priq.c
@@ -218,6 +218,8 @@
    struct ifaltq *ifq;
    int error = 0;

+   memset(&stats, 0, sizeof(stats));
+
    if (*nbytes < sizeof(stats))
            return (EINVAL);

References

• sys/net/altq/altq_priq.c:221 — uninitialized stats.
• sys/net/altq/altq_priq.c:609-627 — get_class_stats partial fill.
• sys/net/altq/altq_priq.c:251 — copyout.
• DF-0652 (cbq), DF-0592 (fairq) — same pattern.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).