{
 "finding_id": "DF-2375",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "FALSE POSITIVE at runtime: the OOB write precondition (32 non-NUL bytes in bif.oeminfo) is structurally unreachable. acpi_cmbat_get_bif fills oeminfo only through acpi_PkgStr(res, i, sc->bif.oeminfo, 32) (acpi_cmbat.c), and acpi_PkgStr rejects a 32-char string with E2BIG (++length 33 > size 32, acpi_package.c:84-86) leaving the bzero()d field empty - so bif.oeminfo ALWAYS contains a NUL within bytes 0..31 and acpi_battery_clean_str never reaches the *str=0 write. Empirically: SSDT _BIF with a 32-char no-NUL oeminfo string returns oeminfo= through ACPIIO_BATT_GET_BIF (the string never lands), and a 0xFF-prefilled user ioctl buffer is wiped by the kernel bzero before the clean_str calls. The off-by-one in acpi_battery_clean_str (acpi_battery.c:331-333) is real as isolated code - retained as hardening (fix_2395.diff writes the last byte instead of one past).",
 "exploit_chain": "",
 "evidence": "run.log (BIF unit=0 ... oeminfo[32]= - empty despite 32-char _BIF oeminfo); poison/check choreography showed no byte-164 OOB write",
 "kernel_refs": [
  "sys/dev/acpica/acpi_battery.c:322",
  "sys/dev/acpica/acpi_battery.c:331",
  "sys/dev/acpica/acpi_battery.c:399",
  "sys/dev/acpica/acpi_package.c:84",
  "sys/dev/acpica/acpi_cmbat.c:445"
 ],
 "poc_changes": "bif_oob.c written for this batch (unprivileged ACPIIO_BATT_GET_BIF with 0xFF prefill + poisoned 164-byte zone)",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}