DF-5451 VERDICT — REPRODUCED (kernel pointer disclosure to unprivileged users)

Finding

nexus_get_resource() — sys/platform/pc64/x86_64/nexus.c:560-576 — contains a leftover debug device_printf() at nexus.c:567-568 that prints, for every bus_get_resource() (and bus_get_resource_start/count, sys/kern/subr_bus.c:3391,3401,3414) on a direct nexus child: - startp/countp: addresses of the caller's output variables — kernel stack addresses; - got %p: the kmalloc'd struct resource_list_entry — kernel heap address.

Reproduction (baseline, kernel #0 Jul 2 2026)

KLD nxget.ko (nexus child) performs one ordinary bus_get_resource():

nxget0: type 3  rid 7  startp 0xfffff801180c7718  countp 0xfffff801180c7720 - got 0xfffff8008dc229d8

The line appears in dmesg AND /var/log/messages (mode 644 on this system); an unprivileged user (uid=1001) read both:

$ dmesg | grep -c startp        -> 1
$ grep -c startp /var/log/messages -> 1

Second run on a different boot leaked different addresses (0xfffff801183a3718 / 0xfffff8008dc22e00) — real per-boot kernel stack and heap addresses, not constants.

Impact

Local unprivileged users observe kernel stack and heap pointers. This system runs without kernel address randomization of these regions, so the immediate value is limited, but the disclosure is unconditional, logged permanently, and becomes KASLR-breaking material on hardened kernels; it is also pure debug cruft with no functional purpose. Trigger requires a driver to call bus_get_resource on a nexus child (rare in-tree — e.g. no current caller; KLD/out-of-tree and future in-tree callers hit it). Severity Low.

Fix validation (kernel #1 Oct 5 17:59:42)

fix.diff deletes the two printf lines. Patched result (fix_run.log): no startp line in dmesg or /var/log/messages; bus_get_resource() still returns 0 with correct values.

Kernel refs

sys/platform/pc64/x86_64/nexus.c:560-576 (printf at 567-568) sys/kern/subr_bus.c:3391, 3401, 3414

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.