DF-5786 — kernel pointer disclosure to unprivileged dmesg readers via

hammer2 debug/error kprintf paths (pass 3; Info — hardening)

No PoC evidence pack: Low/Info hardening finding, verification skipped per audit contract (status recorded as untested by the orchestrator).

What

Unconditional kprintf("%p...") calls in sys/vfs/hammer2/hammer2_chain.c disclose kernel heap/object addresses to the console message buffer, which unprivileged users can read (dmesg/sysctl kern.msgbuf is world-readable on this guest — verified as user maxx during this session):

• hammer2_chain.c:2266 kprintf("hammer2: debug REPTRACK %p->%p\n", parent, reptrack.chain) — reachable whenever hammer2_chain_repparent()'s parent-migration loop cycles (flusher/indirect-maintenance races).
• hammer2_chain.c:2333-2334 kprintf("hammer2: debug repchange %p %p->%p\n", ...) — same machinery.
• hammer2_chain.c:5460-5471 (hammer2_characterize_failed_chain) — prints chain, bdata, dio, bp pointers and buffer geometry on media check failures (krate-limited to 1/sec); check failures are attacker- inducible on a crafted image (mismatched check bytes) or by disk corruption.

Impact

Defeats kernel-address randomization for anyone who can read the message buffer (on guests/KASLR-less configs low value; on hardened configs it is the standard KASLR-bypass primitive). Info severity.

Suggested fix

Drop %p from these messages (print keys/tids instead of addresses), or gate them behind hammer2_debug bits like the neighboring LOST PARENT RETRY message (hammer2_chain.c:3966).