# PoC DF-1554: acpi_cpu_cstate.c zero cst_cx_count -> OOB + atomic poison

**Class:** Signed-int underflow -> heap OOB + persistent bad state
**Cited site:** `sys/dev/acpica/acpi_cpu_cstate.c:530,1140,1144-1145,1142`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/acpica/acpi_cpu_cstate.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

acpi_cst_cx_probe_cst sets cst_cx_count=0; loop only increments on valid sub-package. If ALL sub-packages invalid, count stays 0 but function returns 0 (success) at 687. Sink 1: acpi_cst_set_lowest_oncpu 1140 if (val > sc->cst_cx_count-1) signed-int: 0-1=-1, val clamped to -1, cst_cx_states[-1].type read at 1144-1145 -> 4-byte heap OOB before softc. atomic_swap_int stores -1 -> all subsequent calls also OOB.

## Realistic impact ceiling (on suitable HW)

kernel heap OOB read/write + persistent -1 stored in cst_cx_lowest

## Fix

Return ENXIO from acpi_cst_cx_probe_cst when cst_cx_count==0.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1554.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1554.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```