# DF-2332 — PoC verdict

**File:** `sys/bus/smbus/smbacpi/smbacpi.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

smbus_acpi_space_handler() uses a 32-byte stack buffer char buf[32] but exposes it to ACPI GenericSerialBus transfers (up to 255 data bytes). memcpy(buf,gsb->data,gsb->len) [ATTRIB_BLOCK WRITE] and memcpy(buf,gsb->data,info->AccessLength) [ATTRIB_BYTES WRITE] have no bounds check; values >32 smash the kernel stack.

### Cited lines

- `sys/bus/smbus/smbacpi/smbacpi.c:137`
- `sys/bus/smbus/smbacpi/smbacpi.c:208`
- `sys/bus/smbus/smbacpi/smbacpi.c:223`

## Why it does not reproduce on this guest

No ACPI SMBus (GenericSerialBus) device/AML on the QEMU guest; smbacpi does not attach (the PIIX3 0x7113 node is reported "none", not as an ACPI SMBus opregion). No /dev/smbus*.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Bound-check gsb->len and info->AccessLength against sizeof(buf) (return AE_AML_NUMERIC_OVERFLOW + goto err if exceeded) on both paths.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)