DF-2307 deterministic UAF (BUSAUDIT kernel, planted-ACPI boot:
  hint.acpi.0.rsdp=0x40000000 + QEMU loader aei_chain.bin; stock in-kernel
  gpio_intel/gpio_acpi; aei_race.ko trigger)
====================================================================
# kldload /root/aei/aei_race.ko
console:
aei_race: loaded; arming in 1s.
aei_race: gpio_intel0=0xfffff8008bb7fbc0 gpio_acpi0=0xfffff8008bb7fd00; detaching pair.
gpio_acpi0: detached.
gpio_intel0: detached.
aei_race: planted CTL0(2)=0x40008200 CTL1(2)=0x00000002.
gpio_intel0: <Intel Cherry Trail GPIO Controller> iomem 0xd0000-0xd7fff irq 5 on acpi0.
gpio_acpi0: <ACPI GeneralPurposeIo backend> on gpio_intel0.
gpio_intel0: pin=2 trigger=1 polarity=0 ctrl0=0x40008200 ctrl1=0x00000002.
   <- REAL gpio_cherryview_map_intr ACCEPTED the planted pin-2 config
aei_race: re-attached: gpio_acpi0=0xfffff8008bb61a80
   intrmaps[4].pin=2 handler=0xffffffff80a7ea30 arg=0xfffff8004f102120
   <- the REAL AEI registration: handler=gpio_acpi_aei_handler, arg=info
      (pointer into sc->infos)
aei_race: blocker running on acpi_task (queue held).
   <- real AcpiOsExecute(OSL_GPE_HANDLER) FIFO stalled by our blocker
aei_race: ISR dispatched; handle_event(info=0xfffff8004f102120) queued behind blocker.
   <- real gpio_intel_intr body (lockmgr sc->lk + sc->fns->intr(sc)) with
      the pin-2 IS bit raised dispatched the REAL handler, which queued
      the REAL gpio_acpi_handle_event(info) on the GPE queue
gpio_acpi0: detached.
aei_race: gpio_acpi detach returned 0 (info memset+kfree done).
   <- real device_detach -> gpio_acpi_unmap_aei: TEARDOWN+FREE_INTR,
      memset(info,0), kfree(sc->infos)
aei_race: releasing blocker -> handle_event on freed info.
aei_race: blocker released; queued AEI event now runs on the freed info.
Fatal trap 12: page fault while in kernel mode.
fault virtual address = 0x28
panic: page fault.
<dump; guest dies>

fault address 0x28 = deref of the memset-zeroed info->dev (NULL) inside
gpio_acpi_handle_event's acpi_get_handle(device_get_parent(info->dev))
(gpio_acpi.c:317) -- the deferred ACPI work item executed on freed memory
because gpio_acpi_unmap_aei (:441-458) never drains queued AcpiOsExecute
items ("XXX Wait until ACPI Event handler has finished", :452).

Reachability: root-equivalent (kmod trigger) racing a real GPIO interrupt;
on hardware the IRQ fires by itself (the rig only replaces the physical
line assert with an equivalent direct ISR invocation).