I don't think you even need timing attacks if you can read the zpool statistics; you can ask for a histogram of deduped blocks.

Guessing one byte at a time is not possible though because dedupe is block-level in ZFS.

Gosh, you’re likely right, but what if comparing the blocks (to decide on deduping) is a byte at a time and somehow that can be detected (with a timing channel or a uarch side channel)? Zfs likely compares the hash, but I think KSM doesn’t use hashes but memcmp (or something in that spirit) to avoid collisions. So just maybe… just maybe GP is onto something.. interesting fantasy ;-)

Thanks for putting meat on the (speculitive) bone I threw out! Very interesting.

VMWare ESXi used to dedupe RAM and had to disable this by default because of a security issue it caused that leaded data between VMs.