# DF-2374 VERDICT

**Status:** not_reproduced
**Impact:** corruption
**Confidence:** likely
**Attempts:** 3

Race window is real by construction (acpiioctl drops ACPI_LOCK at acpi.c:3421 and calls hp->fn at :3426 holding only acpi_token, while acpi_deregister_ioctl at :3247-3260 takes neither) but could not be closed empirically: 1,607,354 hook dispatches against 5,175 deregister+canary-refill+reregister churn cycles produced zero faults. The ~10-instruction window plus immediate re-registration reusing the same 32-byte chunk (fn pointer rewritten to the valid function) makes a black-box hit a lottery; exploitation would need precise heap choreography.

## Kernel references
- `sys/dev/acpica/acpi.c:3418`
- `sys/dev/acpica/acpi.c:3421`
- `sys/dev/acpica/acpi.c:3426`
- `sys/dev/acpica/acpi.c:3247`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.