{
 "finding_id": "DF-2372",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "AcpiOsReadPciConfiguration Width=32 masked every 32-bit PCI config read to zero on the live kernel: raw pci_cfgregread(0:0.0, reg 0, 4) = 0x12378086 while the ACPI path returned 0x00000000 (Width=16 intact at 0x8086). Root cause confirmed at OsdHardware.c:106: (1 << (bytes*8)) - 1 with bytes==4 is the UB shift 1<<32, emitted by clang as a 5-bit-masked shl yielding (1<<0)-1 == 0. Fixed kernel (fix.diff: 64-bit mask) returns the real 0x12378086 at Width=32.",
 "exploit_chain": "AML/ACPICA PCI config reads (e.g. _DSM device detection) silently see 0 instead of real config data - firmware decisions and any AML-driven PCI access are corrupted; no direct kernel memory-safety impact",
 "evidence": "run.log lines 3-6 (Width=32 value 0x0 vs raw 0x12378086); fixed.log line 4 (Width=32 value 0x12378086)",
 "kernel_refs": [
  "sys/dev/acpica/Osd/OsdHardware.c:96",
  "sys/dev/acpica/Osd/OsdHardware.c:104",
  "sys/dev/acpica/Osd/OsdHardware.c:106"
 ],
 "poc_changes": "rig op pciub32 written for this batch; no PoC source existed before",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 900,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "936ecb01ceac8463f331abe35dfd5655f26f201d6d68cc0e4552956360404b31",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}