# DF-2375 VERDICT

**Status:** not_reproduced
**Impact:** none
**Confidence:** certain
**Attempts:** 3

FALSE POSITIVE at runtime: the OOB write precondition (32 non-NUL bytes in bif.oeminfo) is structurally unreachable. acpi_cmbat_get_bif fills oeminfo only through acpi_PkgStr(res, i, sc->bif.oeminfo, 32) (acpi_cmbat.c), and acpi_PkgStr rejects a 32-char string with E2BIG (++length 33 > size 32, acpi_package.c:84-86) leaving the bzero()d field empty - so bif.oeminfo ALWAYS contains a NUL within bytes 0..31 and acpi_battery_clean_str never reaches the *str=0 write. Empirically: SSDT _BIF with a 32-char no-NUL oeminfo string returns oeminfo='' through ACPIIO_BATT_GET_BIF (the string never lands), and a 0xFF-prefilled user ioctl buffer is wiped by the kernel bzero before the clean_str calls. The off-by-one in acpi_battery_clean_str (acpi_battery.c:331-333) is real as isolated code - retained as hardening (fix_2395.diff writes the last byte instead of one past).

## Kernel references
- `sys/dev/acpica/acpi_battery.c:322`
- `sys/dev/acpica/acpi_battery.c:331`
- `sys/dev/acpica/acpi_battery.c:399`
- `sys/dev/acpica/acpi_package.c:84`
- `sys/dev/acpica/acpi_cmbat.c:445`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.