# DF-2228 — PoC verdict

**File:** `sys/gnu/dev/misc/apple_gmux/apple-gmux.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

apple_gmux_detach() calls AcpiRemoveNotifyHandler() expecting it to drain in-flight deferred dispatches, but DragonFly AcpiOsWaitEventsComplete() is a compile-time no-op stub, so a previously-queued AcpiEvNotifyDispatch still holds a raw pointer to the freed handler object (UAF).

### Cited lines

- `sys/gnu/dev/misc/apple_gmux/apple-gmux.c:919-929`
- `sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219-220`

## Why it does not reproduce on this guest

apple_gmux is MacBook-only (Apple gmux ACPI device); not present on QEMU/BOCHS, module not loaded.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

In apple_gmux_detach, after AcpiDisableGpe and before AcpiRemoveNotifyHandler, add AcpiOsSleep(10) to yield to the ACPI helper thread and drain deferred dispatches. Notes the systemic root cause is the no-op AcpiOsWaitEventsComplete stub.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)