DF-2854 VERDICT — REPRODUCED (baseline) / fixed by bzero (validated)

Bottom line

On the stock kernel, an unprivileged user (uid 1001, no groups, securelevel -1) reading hw.bus.rman receives, per exported entry, up to 31 bytes of uninitialized kernel stack from struct u_resource.r_devname (and per-rman rm_descr), plus the 4 trailing pad bytes (DF-0092). On this guest the residue is a live kernel virtual address repeated in every entry:

r_devname tail: "acpi0" | raw: 61 63 70 69 30 00 ff ff 00 58 ee 17 01 f8 ff ff
                                  a c p i 0  \0  …  [  = 0xfffff80117ee5800  ]
tail pad bytes 76-79: ff ff ff ff

88 resources + 5 rman descriptors were exported → 99 “UNINITIALIZED” marks per run; byte-for-byte identical across 3 runs (stable stack residue; deterministic on this boot). See run.log / leak_sample.txt.

Why it leaks (path:line)

• sys/kern/subr_rman.c:653-654 — struct u_rman urm; struct u_resource ures; are uninitialized stack locals.
• :684 strlcpy(urm.rm_descr, …) writes only strlen+1 of 32 bytes; :707-716 ksnprintf/“nomatch”/'\0' write only strlen+1 of 32 bytes of r_devname.
• :690 and :722 SYSCTL_OUT(req, &x, sizeof(x)) copy the entire struct (80 bytes) to userland.
• :734 the node is CTLFLAG_RD — world-readable (lib/libdevinfo walks it as a normal user; our PoC needed no privileges).
• Contrast: the sibling sysctl_devices handler deliberately does bzero(&udev, sizeof(udev)) (sys/kern/subr_bus.c:3892) — sysctl_rman simply forgot.

Relation to DF-0092 (not a re-report)

DF-0092 covers the 4 trailing padding bytes only and asserts the named fields are set. They are not: the partially-initialized string fields leak up to 31 bytes each — a distinct, ~8x larger surface in the same function, with kernel-pointer content demonstrated. DF-0092’s suggested struct u_resource ures = {}; would incidentally fix this too; the root-cause statement (“named fields set”) is what this finding corrects.

Impact ceiling

Kernel-stack disclosure to any local user: kernel pointers (KASLR / heap-layout reconnaissance; useful to weaponize adjacent memory bugs), possibly other residue depending on prior use of the reader’s kstack. No write primitive. Rubric: “local info leak of limited kernel memory” → Medium, bucket kernleak.

PoC changes (poc_changes)

• No seed; walker mirrors lib/libdevinfo/devinfo.c:263-345 (OID resolution via sysctl(0,3), generation from hw.bus.info).
• First cut had a wrong struct u_businfo (used a generation-first layout; kernel’s is {int ub_version; int ub_generation} per sys/sys/bus.h:67) — every request returned EINVAL until fixed.
• Run as unprivileged maxx via vm.sh run_user.

Fix validation

• fix.diff: bzero(&urm, sizeof(urm)) / bzero(&ures, sizeof(ures)) before filling (mirrors subr_bus.c:3892).
• Applied in guest together with DF-2853’s guard; single make nativekernel + installkernel + reboot.
• Patched-kernel expectation (met): all r_devname/rm_descr tails and the 4 pad bytes read as zero; grep -c UNINITIALIZED → 0.

Kernel references

• sys/kern/subr_rman.c:653-654, :684, :702-722, :734
• sys/kern/subr_bus.c:3892 (correct bzero pattern)
• lib/libdevinfo/devinfo.c:263-345 (unprivileged walk precedent)