Summary

drm_agp_info_ioctl L79 struct drm_agp_info info; on stack without zeroing. drm_agp_info L62-70 fills 9 named fields covering bytes 0..51 of 56-byte struct on amd64 (two unsigned short at offset 48/50 leaves 4 bytes trailing padding to 8-byte align). Struct assignment L86 *(struct drm_agp_info*)data=info; may compile to 56-byte memcpy copying uninitialized padding bytes 52..55 from stack frame. AGP_INFO only AGP ioctl gated solely by DRM_AUTH (drm_ioctl.c:629) reachable from any DRM-authenticated local client. sys_generic.c:691-697 bzeros data for IOC_OUT but if gcc -O2 lowers struct assign to movq-pair the zeroed bytes overwritten by uninitialized info frame bytes. Preconditions: DRM device open+authenticated AND dev->agp->acquired true (X server AGP_ACQUIRE). Any unpriv local user DRM_IOCTL_AGP_INFO inspect last 4 bytes. Limited KASLR breadcrumb/stack-content oracle. Fix: struct drm_agp_info info={0}; zero-init.