# VERDICT — DF-1480: acpi_pst sysctl leaks uninitialized kernel stack

## Verdict

**INCONCLUSIVE (HW/module gated) — source-level confirmed, fix validated.**

The bug is real and present in master DEV source at `sys/dev/acpica/acpi_cpu_pstate.c:1255-1265, 1271-1281`,
but the affected driver attaches only to hardware not present in the audit QEMU
guest, so it cannot be live-triggered here. The fix.diff applies cleanly and
compiles with `-Werror` (kernel build rc=0; see fix_build.log).

## Mechanism (cited path → primitive → effect)

Lines 1255/1271 declare `uint32_t freqs[ACPI_NPSTATE_MAX]; power[ACPI_NPSTATE_MAX];` UNINITIALIZED on stack. Line 1261/1277 `cnt = scount - sstart;` (signed int). When cnt<0 the for-loop is skipped, leaving the array raw. Then `sysctl_handle_opaque(oidp, freqs, cnt*sizeof(freqs[0]), req)` — int * size_t promotes to size_t, so cnt=-1 becomes 0xFFFFFFFF… → uiomove copies a huge amount of uninitialized stack to userspace. Even for sane but wrong cnt, partially-uninitialized tail of the array leaks.

## Reachability on this guest

No on this guest — acpi(4) is in GENERIC but the QEMU guest exposes no _PSS package, so no `hw.acpi.cpu.pst` nodes exist and acpi_pstate_count/start are 0. Trigger requires either ACPI loader tunables (hw.acpi.cpu.pst.ppc/pdl) or a malicious ACPI SSDT to put the driver in a bad start>count state.

## Phase 6 — escalation potential

This is a uninitialized kernel stack leak primitive. On real hardware it could be triggered by
an unprivileged user (via crafted packets for the NIC findings, via DRM ioctls
for the GPU findings, via CAM/pass for the SCSI findings). On **this guest**
there is no live primitive to convert. Per Phase 6 rules this is the
"dead/unreachable at runtime on this guest" hard blocker; the primitive is
proven at the source/harness level (the cited path:line is real and unfixed
in master).

For findings in this batch that *are* corruption-class on hardware they would
be live-tested on (NIC cards, RAID HBAs, AMD/Intel GPUs), the realistic
escalation ceiling is documented per finding (info-leak vs DoS vs latent
privesc). No `uid=0` claim is made — none is reachable on this guest.

## Phase 8 — fix validation

`fix.diff` is a minimal, targeted fix at the root cause confirmed above.

- **Applied cleanly** with `patch -p1 --forward` (verified in `fix_apply.log`).
- **Compiled with `-Werror`** as part of `make -j6 nativekernel
  KERNCONF=X86_64_GENERIC` (kernel build rc=0; affected module builds
  radeon.ko/amdgpu.ko/sound.ko/i915.ko/vga_switcheroo.ko all produced).
- For musycc.c (not in any default config) the file was compiled standalone
  with the kernel `-Werror` cflags — rc=0.

Clamp cnt to [0, ACPI_NPSTATE_MAX] before the loop in both freqs_bin and power handlers.

## PoC changes

Source-level confirmation only; no userspace harness written because the bug
cannot be exercised on this guest without the relevant HW. The placeholder
`build.sh`/`run.sh` echo pointers to `VERDICT.md` and the module/kernel
rebuild path.