Earlier quoted context omitted.
Is it even exploitable in the real world? Correct me if I'm wrong but you get 2 bytes of kernel data (potentially blank padding) and the same two bytes each time?
If the linker puts a pointer there, this would let you leak part of the pointer which could let you bypass kaslr. Not too likely for that to occur. If I were submitting this bug I would feel complete if they bought me a sandwich.
The bottom 2 bytes of a pointer contain two bits of the slide, assuming it's even a pointer into the kernelcache itself.
I'd take half a sandwich.