DF-3258 VERDICT — uninitialized dr[8..15] disclosure via /proc//dbregs + PT_GETDBREGS

Status: REPRODUCED (leak), unprivileged, 3/3 runs, fix validated

Root cause (line-accurate)

1. sys/cpu/x86_64/include/reg.h:89-96 — struct dbreg { unsigned long dr[16]; } with indices 8-15 documented "reserved".
2. sys/platform/pc64/x86_64/machdep.c:3104-3129 — fill_dbregs() assigns dr[0..3] (pcb_dr0-3), dr[4]=0, dr[5]=0, dr[6] (pcb_dr6), dr[7] (pcb_dr7). dr[8..15] are never written. (Same in the vkernel twin, sys/platform/vkernel64/x86_64/cpu_regs.c:782.)
3. sys/vfs/procfs/procfs_dbregs.c:57 — struct dbreg r; lives on the kernel stack uninitialized; procfs_dbregs.c:65-67 fills it via procfs_read_dbregs → fill_dbregs, then uiomove_frombuf(&r, sizeof(r), uio) copies all 128 bytes to userspace. The read path requires only that the reader may inspect the target (CHECKIO + p_trespass, procfs_dbregs.c:62), which always holds for one's own process — the leaked stack is the reader's own thread's kernel stack (the uio is serviced synchronously in the reader's syscall context).
4. sys/kern/sys_process.c:546-555 — PT_GETDBREGS constructs a sizeof(struct dbreg)-sized kernel uio over the caller's buffer and calls the same procfs_dodbregs → identical leak through ptrace.

Contrast: fill_regs (machdep.c:3009-3017) bcopy's the entire struct reg from the trapframe, and fill_fpregs bcopy's the full fpu save area — fill_dbregs is the only partial initializer of the three.

Observation (stock kernel, run as uid=1001 maxx)

See run.log / run.2.log / leak_sample.txt:

• procfs path: 37/64, 33/64, 34/64 non-zero bytes in dr[8..15].
• ptrace path: 40/64, 47/64 non-zero.
• Stable kernel pointers across runs: fffff800905f7980 (kernel heap), fffff8011830f7f8, fffff800899794a8 (kernel stack region), ffffffff8064ced0, ffffffff80680348 (kernel text/data).
• dr[0..7] always zero (target has no debug registers set) — the tail is pure uninitialized stack, not register state.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 ... X86_64_GENERIC, cc 8.3, 6 vCPU. /tmp is tmpfs. Runs: 2026-09-09.

Exploit chain / impact ceiling

Not a corruption primitive — an information disclosure. Ceiling: 64 bytes of arbitrary-depth kernel stack residue per read, at will, from any unprivileged process; direct kernel pointers defeat address-space randomization of kernel text/heap/stack (relevant on hardened systems; this guest runs without KASLR, where the value is reconnaissance of live kernel data structures — e.g. pcb/proc pointers usable to defeat independence assumptions of follow-up bugs).

Fix validation

fix.diff: bzero(dbregs, sizeof(*dbregs)); at the top of fill_dbregs (single chokepoint for procfs + PT_GETDBREGS). Applied inside the guest's /usr/src, make -j6 nativekernel KERNCONF=X86_64_GENERIC, reboot.

• Baseline (stock kernel): dr[8..15] = 33-47 non-zero bytes / 64 (3 runs).
• Patched kernel: dr[8..15] = 0 non-zero bytes / 64 on both paths (see run.patched.log); dr[0..7] unchanged (all zeros here); PT_SETDBREGS path unaffected (set_dbregs ignores dr[8..15]).
• No regressions observed: dbregs write of 128 bytes to a stopped same-uid target still works; fifo/procfs smoke clean after reboot.

Files

• dbregs_leak.c — trigger (procfs + ptrace modes)
• run.log, run.2.log — vulnerable-kernel runs (3 leak samples)
• run.patched.log — post-fix run
• kbuild-tail.log — kernel build completion proof
• leak_sample.txt — extracted dr[8..15] samples
• fix.diff — the validated fix
• env.txt — guest environment

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.