# DF-2376 VERDICT

**Status:** reproduced (reproduced)
**Impact:** panic
**Confidence:** certain
**Attempts:** 4

Deferred acpi_cmbat task ran AFTER the softc was freed and dereferenced the NULL dev->softc set by the detach-time free - Fatal trap 12 at acpi_cmbat_get_bif+0xaa (movl 0xc(%r13),%r8d, fault 0xc = sc->bix_present via NULL softc), current process Idle (acpi_task helper thread). Choreography (console-narrated): blocker queued on acpi_task; Notify(BAT2, 0x81) queues the notify dispatch behind it; softc freed exactly as device_set_driver() does at detach (kfree M_BUS + softc=NULL); blocker timeout lets the dispatch run, the handler queues acpi_cmbat_get_bif_task, and the task runs against the freed device - AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219-220) so nothing drains the queue. The pass-2 note claiming a DF-4823-validated drain closes this is wrong: the OSL has no drain at all.

## Kernel references
- `sys/dev/acpica/acpi_cmbat.c:154`
- `sys/dev/acpica/acpi_cmbat.c:202`
- `sys/dev/acpica/acpi_cmbat.c:443`
- `sys/dev/acpica/Osd/OsdSchedule.c:119`
- `sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.