{
 "finding_id": "DF-2381",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Deferred acpi_fujitsu_notify_status_changed ran on the freed+canary-sprayed softc and dereferenced sc->dev = 0x4141414141414141 - Fatal trap 12 at device_get_parent+0x0 (movq 0x28(%rdi),%rax, fault 0x28), current process Idle (acpi_task helper). Choreography (console-narrated): blocker on acpi_task; Notify(FJS0, 0x80) queues the dispatch behind it; softc freed (kfree M_BUS 208-byte zone) + 0x41-sprayed exactly as detach does; blocker timeout -> dispatch -> handler queues acpi_fujitsu_notify_status_changed(sc) -> acpi_fujitsu_update -> acpi_device_get_parent_softc(sc->dev) faults. Confirms AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219-220) and detach drains nothing.",
 "exploit_chain": "firmware notify 0x80 + detach without drain -> deferred callback on freed softc -> wild pointer deref; with heap grooming the freed 208-byte chunk can carry attacker-chosen sc->dev/sc->handle consumed by device/AcpiEvaluateObject paths - memory-corruption primitive beyond the panic",
 "evidence": "panic.txt (Fatal trap 12, fault virtual address 0x28, Stopped at device_get_parent: movq 0x28(%rdi),%rax); run.log console narration (softc 0xfffff8008bb47d10 size 208 freed+canaried; blocker out at 30s)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:301",
  "sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:331",
  "sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:341",
  "sys/dev/acpica/Osd/OsdSchedule.c:119",
  "sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219"
 ],
 "poc_changes": "blocker choreography op run_fufreed written for this batch",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}