Garrett D'Amore wrote:
> If I had a little more time, I'd go ahead and try to fix the kernel
> grovelers myself.  I don't know how many of them are out there, but
> there aren't many.

egrep -rl '(getbootfile|kvm_openfiles)' /usr/src/*bin  turns up:

sbin/savecore
sbin/ccdconfig
usr.bin/fstat
usr.bin/ipcs
usr.bin/netstat
usr.bin/nfsstat
usr.bin/pkill
usr.bin/pmap
usr.bin/systat
usr.bin/vmstat
usr.bin/w
usr.sbin/ifmcstat
usr.sbin/kgmon
usr.sbin/mlxctl
usr.sbin/ntp
usr.sbin/pstat
usr.sbin/trpt
usr.sbin/trsp

If there are any grovelers that don't actually use getbootfile
or kvm_openfiles, they'll be in addition to the list above.

From experience, netstat usually misbehaves silently if it is looking
at the wrong kernel, say by giving reasonable-looking but incomplete
lists of listening sockets for -a. In netstat's case I confirmed that
was the problem (and not, say, that I'd been rooted by some stealthy
bugger) by getting the correct results after specifying the correct
kernel.  I haven't systematically checked to see how all the others
behave; of course one would prefer to get an error or obvious nonsense,
but that seems very rarely to be what really happens.  (I first noticed
the trouble with savecore when it was saying wd0a wasn't readable,
which concerned me until I remembered that machine hasn't got a wd0a,
and then concerned me a different way).

My feeling's that a system known to ship with at least 18 kvm grovellers
ought also to ship with a simple, prominently documented workaround
for use cases where the grovellers would otherwise show heisenbehavior,
and that it should ship that way for as long as it takes for sysctl to
be extended with all of the internal interfaces needed by the >= 18
grovellers, and for them to be rewritten to use it.

-Chap