# DF-2381 VERDICT

**Status:** reproduced (reproduced)
**Impact:** panic
**Confidence:** certain
**Attempts:** 3

Deferred acpi_fujitsu_notify_status_changed ran on the freed+canary-sprayed softc and dereferenced sc->dev = 0x4141414141414141 - Fatal trap 12 at device_get_parent+0x0 (movq 0x28(%rdi),%rax, fault 0x28), current process Idle (acpi_task helper). Choreography (console-narrated): blocker on acpi_task; Notify(FJS0, 0x80) queues the dispatch behind it; softc freed (kfree M_BUS 208-byte zone) + 0x41-sprayed exactly as detach does; blocker timeout -> dispatch -> handler queues acpi_fujitsu_notify_status_changed(sc) -> acpi_fujitsu_update -> acpi_device_get_parent_softc(sc->dev) faults. Confirms AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219-220) and detach drains nothing.

## Kernel references
- `sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:301`
- `sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:331`
- `sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:341`
- `sys/dev/acpica/Osd/OsdSchedule.c:119`
- `sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.