# DF-1220 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
acpi_eval_osc() dereferences _OSC return without validating it is a Buffer

## Source Location
sys/dev/acpica/acpi.c:1326-1354

## Verdict
Source-confirmed: acpi_eval_osc() dereferences _OSC return without validating it is a Bu. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
acpi_eval_osc() at acpi.c:1326-1354: after AcpiEvaluateObject(_OSC) succeeds, indexes retobj->Buffer.Pointer as uint32_t[] at :1329/:1341/:1352 without checking retobj->Type==ACPI_TYPE_BUFFER or Buffer.Length>=count*sizeof(uint32_t). ACPI_OBJECT is union: if BIOS returns INTEGER, Buffer.Pointer aliases Integer.Value -> wild pointer deref. Crafted/buggy _OSC returning Return(0x41414141) panics kernel at boot. For loop at :1352 reads count dwords regardless of actual buffer length -> OOB read. Req