# DF-2373 VERDICT

**Status:** reproduced (reproduced)
**Impact:** leak
**Confidence:** certain
**Attempts:** 3

Stock X86_64_GENERIC kernel with debug.acpi.allow_method_calls=1: ACPIIO_DO_MCALL on a Package-returning method hands the caller the full ACPICA result buffer with every internal pointer unfixed - top-level Package.Elements plus each nested sub-package Elements remain raw kernel virtual addresses. 3/3 runs leaked 7+ KVA pointers each (0xfffff801... heap layout). Gated: root FWRITE on /dev/acpi plus the boot-time loader tunable (unprivileged O_RDONLY ioctl returns EPERM - verified).

## Kernel references
- `sys/dev/acpica/acpi.c:3391`
- `sys/dev/acpica/acpi.c:3398`
- `sys/dev/acpica/acpi.c:3380`
- `sys/dev/acpica/acpi.c:3458`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.