syslog: read the captured /var/log/dmesg under KASLD_SYSROOT

mmap_syslog tried klogctl first unconditionally, so during offline analysis
of a captured tree (KASLD_SYSROOT set) every dmesg component read the live
HOST kernel log instead of the analysed tree. Skip klogctl when a sysroot is
set and read the captured /var/log/dmesg; with no sysroot the klogctl-first
live path is unchanged (the file stays the fallback when klogctl is denied).
Fixes replay/offline correctness for all dmesg_search components at one point.

dmesg_backtrace: drop its now-duplicated sysroot branch and just call
mmap_syslog.

Author: bcoles

src/components/dmesg_backtrace.c

@@ -338,20 +338,17 @@ static void on_line(char *line, void *vctx) {
 
 /* Walk every line of the kernel log in order, calling fn(line, ctx) per line.
  *
- * A single source is used so line order — hence dump-block structure — is
- * preserved: under KASLD_SYSROOT the captured /var/log/dmesg (klogctl would
- * read the live host, not the analysed tree); otherwise klogctl, with the file
- * as fallback. The mapping is left to be reclaimed at process exit — these
- * components are one-shot (the same convention as the shared dmesg helper).
- * Returns 0 on success, -1 if no source is accessible. */
+ * mmap_syslog gives a single ordered source so line order — hence dump-block
+ * structure — is preserved: klogctl on a live system, or the captured
+ * /var/log/dmesg under KASLD_SYSROOT (mmap_syslog handles that redirect). The
+ * mapping is left to be reclaimed at process exit — these components are
+ * one-shot. Returns 0 on success, -1 if no source is accessible. */
 typedef void (*line_fn)(char *line, void *ctx);
 static int foreach_dmesg_line(line_fn fn, void *ctx) {
   char *buf;
   int size;
 
-  int rc = kasld_sysroot() ? read_dmesg_log_file(&buf, &size)
-                           : mmap_syslog(&buf, &size);
-  if (rc != 0 || size <= 0)
+  if (mmap_syslog(&buf, &size) != 0 || size <= 0)
     return -1;
 
   /* The mmap allocation is page-rounded strictly above `size`, so buf[size] is

src/include/syslog.h

@@ -73,6 +73,14 @@ static int read_dmesg_log_file(char **buffer, int *size) {
 static int mmap_syslog(char **buffer, int *size) {
   int alloc;
 
+  /* Offline analysis: under KASLD_SYSROOT, klogctl() would read the live HOST
+   * kernel log, not the analysed tree, so read the captured /var/log/dmesg
+   * instead. With no sysroot set (the normal case) this falls through to the
+   * klogctl-first path below (the live ring buffer is authoritative; the file
+   * is only the fallback when klogctl is denied). */
+  if (kasld_sysroot())
+    return read_dmesg_log_file(buffer, size);
+
   *size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
   if (*size == -1) {
     perror("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER)");

src/rules/x86_64_la57_from_directmap.c

@@ -103,7 +103,12 @@ int rule_x86_64_la57_from_directmap(const struct evidence_set *ev,
       snprintf(c->origin, ORIGIN_LEN, "x86_64_la57_from_directmap");
     }
   } else {
-    /* L4: raise the virt_page_offset floor to the L4 VAS start. */
+    /* L4: raise the virt_page_offset floor to the L4 VAS start. Deliberately
+     * the canonical half floor (0xffff800000000000), NOT __PAGE_OFFSET_BASE_L4
+     * (0xffff888000000000): the PTI LDT remap sits at 0xffff880000000000, and
+     * pre-v4.17 kernels based the directmap at 0xffff880000000000 — a higher
+     * floor would reject legitimate / older-kernel bases. Do not "tighten" this
+     * to __PAGE_OFFSET_BASE_L4; see proc_cpuinfo.c for the full rationale. */
     if (n < out_max) {
       struct constraint *c = &out[n++];
       memset(c, 0, sizeof(*c));