{
 "finding_id": "DF-2376",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Deferred acpi_cmbat task ran AFTER the softc was freed and dereferenced the NULL dev->softc set by the detach-time free - Fatal trap 12 at acpi_cmbat_get_bif+0xaa (movl 0xc(%r13),%r8d, fault 0xc = sc->bix_present via NULL softc), current process Idle (acpi_task helper thread). Choreography (console-narrated): blocker queued on acpi_task; Notify(BAT2, 0x81) queues the notify dispatch behind it; softc freed exactly as device_set_driver() does at detach (kfree M_BUS + softc=NULL); blocker timeout lets the dispatch run, the handler queues acpi_cmbat_get_bif_task, and the task runs against the freed device - AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219-220) so nothing drains the queue. The pass-2 note claiming a DF-4823-validated drain closes this is wrong: the OSL has no drain at all.",
 "exploit_chain": "notify 0x81 (firmware-controlled) + driver detach without drain -> deferred task on freed softc -> kernel panic; kernel-heap grooming of the freed softc could redirect the sc writes (silent write-after-free captured in variant (a) planning) toward controlled corruption",
 "evidence": "panic.txt (Fatal trap 12, fault virtual address 0xc, Stopped at acpi_cmbat_get_bif+0xaa, current process Idle); run.log console narration (blocker; NB2; softc freed; blocker out at 30s)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_cmbat.c:154",
  "sys/dev/acpica/acpi_cmbat.c:202",
  "sys/dev/acpica/acpi_cmbat.c:443",
  "sys/dev/acpica/Osd/OsdSchedule.c:119",
  "sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219"
 ],
 "poc_changes": "blocker choreography op run_batfreed written for this batch; device_delete_child deadlocked the rig so the detach-time kfree(M_BUS)+softc=NULL is emulated directly",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}