DF-4358 — DF-added kprintf leaks kernel pointers at amdgpu load (Info)

Where

sys/dev/drm/amd/amdgpu/amdgpu_kms.c:185-186 (amdgpu_driver_load_kms):

    kprintf("amdgpu_driver_load_kms(): flags=%ld drm_device=%p adev=%p\n",
        flags, dev, adev);

This kprintf does not exist upstream (v5.0/v5.2/v5.4 verified) — it is a DragonFly-port debug leftover. It prints the kernel virtual addresses of the drm_device and the struct amdgpu_device heap object to the console message buffer every time an amdgpu card attaches, i.e. at boot on any system with an AMD GPU. Unprivileged users can read the message buffer (dmesg, /var/log) on a default DragonFly system.

Impact is deliberately rated Info: DragonFly has no KASLR, so heap addresses carry little exploitation value today; the value is (a) removing gratuitous %p disclosure that would defeat any future KASLR/slab-random hardening and (b) diverging noise from upstream. Same class as DF-2008.

Fix

fix.diff deletes the two lines (upstream state).

DF-4358 VERDICT — kprintf %p pointer disclosure (Info)

Status: UNTESTED (Info-severity hardening finding; no PoC required per audit contract — "Skip for Low/Info hardening findings").

Certainty of the finding itself: certain (source is one grep away, amdgpu_kms.c:185-186, and upstream v5.0/5.2/5.4 verified not to have it). Demonstrating the print at runtime requires an AMD GPU to attach, which this audit guest does not have; the kprintf is unconditional at attach, so behavioral verification would be trivial on any AMD-equipped host.

Impact ceiling: kernel heap pointer disclosure to unprivileged local users via dmesg; near-zero practical value on KASLR-less DragonFly today.

Fix: remove the kprintf (fix.diff; apply-check OK on guest /usr/src; compile-validated by the patched buildkernel run).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.