Created attachment 150736 [details]
Patch for procstat_auxv.c

The ELF auxiliary vector displayed by `procstat -x` contains
information about whether or not the stack for that process is
executable or not.

This information is currently reversed, showing executable
when nxstack is enabled. It can be reproduced quite easily:

# sysctl kern.elf64.nxstack
kern.elf64.nxstack: 1
# procstat -x $$ | grep AT_STACKPROT
 1471 csh              AT_STACKPROT     EXECUTABLE

After disabling nxstack, new processes show nonexecutable.

# sysctl kern.elf64.nxstack=0
kern.elf64.nxstack: 1 -> 0
# sh -c 'procstat -x $$ | grep AT_STACKPROT'
 1477 sh               AT_STACKPROT     NONEXECUTABLE


Looking at the procstat code, the displayed string labels are
reversed for the check. The bitwise and will return !0 if the
executable bit is set.

      if ((auxv[i].a_un.a_val & VM_PROT_EXECUTE) != 0)
        PRINT(AT_STACKPROT, %s, "NONEXECUTABLE");
      else
        PRINT(AT_STACKPROT, %s, "EXECUTABLE");
      break;

Attached is a simple patch to switch the labels.