{
 "finding_id": "DF-2373",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Stock X86_64_GENERIC kernel with debug.acpi.allow_method_calls=1: ACPIIO_DO_MCALL on a Package-returning method hands the caller the full ACPICA result buffer with every internal pointer unfixed - top-level Package.Elements plus each nested sub-package Elements remain raw kernel virtual addresses. 3/3 runs leaked 7+ KVA pointers each (0xfffff801... heap layout). Gated: root FWRITE on /dev/acpi plus the boot-time loader tunable (unprivileged O_RDONLY ioctl returns EPERM - verified).",
 "exploit_chain": "root-gated kernel heap address disclosure (KASLR defeat primitive); no direct memory corruption",
 "evidence": "run.log runs 1-3 (Package.Elements = 0xfffff80118684018, elem[0..5] nested Elements all raw KVA); reach.log (unpriv ioctl EPERM)",
 "kernel_refs": [
  "sys/dev/acpica/acpi.c:3391",
  "sys/dev/acpica/acpi.c:3398",
  "sys/dev/acpica/acpi.c:3380",
  "sys/dev/acpica/acpi.c:3458"
 ],
 "poc_changes": "seed mcall_leak.c from the pack was already runnable; re-ran on a fresh stock boot with the loader tunable, added the unprivileged-reachability probe",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}