{
 "finding_id": "DF-2374",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "Race window is real by construction (acpiioctl drops ACPI_LOCK at acpi.c:3421 and calls hp->fn at :3426 holding only acpi_token, while acpi_deregister_ioctl at :3247-3260 takes neither) but could not be closed empirically: 1,607,354 hook dispatches against 5,175 deregister+canary-refill+reregister churn cycles produced zero faults. The ~10-instruction window plus immediate re-registration reusing the same 32-byte chunk (fn pointer rewritten to the valid function) makes a black-box hit a lottery; exploitation would need precise heap choreography.",
 "exploit_chain": "",
 "evidence": "race.log (hook_racer: 1607354 ioctls in 90s; churn stopped: calls=1607354 regs=5175 deregs=5175, no panic)",
 "kernel_refs": [
  "sys/dev/acpica/acpi.c:3418",
  "sys/dev/acpica/acpi.c:3421",
  "sys/dev/acpica/acpi.c:3426",
  "sys/dev/acpica/acpi.c:3247"
 ],
 "poc_changes": "rig ops hook_reg/hook_churn_start/hook_churn_stop + userland racer written for this batch",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 240,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}