# DF-2379 — PoC verdict

**File:** `sys/dev/acpica/acpi_cpu_pstate.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

acpi_pst_sysctl_freqs_bin() and acpi_pst_sysctl_power() compute cnt=count-start from two globals not maintained under the invariant count>=start. With inconsistent _PPC/_PDL across CPUs cnt goes negative; cnt*sizeof(...) sign-extends to a huge size_t in sysctl_handle_opaque and copyout reads uninitialized kernel stack from the on-stack freqs[]/power[] buffers.

### Cited lines

- `sys/dev/acpica/acpi_cpu_pstate.c:1255-1265`
- `sys/dev/acpica/acpi_cpu_pstate.c:1271-1281`
- `sys/dev/acpica/acpi_cpu_pstate.c:168-169`

## Why it does not reproduce on this guest

No ACPI CPU P-states on the QEMU guest: sysctl hw.acpi.cpu.px_dom0.avail returns "unknown oid"; only C-states (cx) are present. The sysctl readers cannot be exercised without _PSD/_PCC/_PPC P-state packages.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Clamp cnt to [0, ACPI_NPSTATE_MAX] in both sysctl readers before using it as a count/length.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)