# DF-2384 — Missing Buffer.Length check in acpi_hp_exec_wmi_command

**File:** `sys/dev/acpica/acpi_hp/acpi_hp.c:838-860`
**Verdict:** **REPRODUCED** — see `VERDICT.md` + `verdict.json`

## Harness

Same verbatim-interposition kernel harness as DF-2383 (shared
`hp_sim.c`, shared `HPHARNESS` kernel): the REAL `acpi_hp.c` compiled
verbatim, attached under the real `hw.acpi` tree; the interposed
`evaluate_call` returns crafted BIOS reply objects selected by
`hw.hpsim.reply_mode`:

| mode | reply object | baseline result |
|---|---|---|
| 0 | Buffer, Length=12 (conformant) | `display: 683` (control) |
| 1 | Length=4; canaries 0x41414141@+4, 0x42424242@+8 | `display: 1094795585` — OOB word surfaced to userland (root **and unprivileged**) |
| 2 | Length=4, tight allocation (`debug.use_malloc_pattern=1`) | `display: -1` — uninitialized allocation tail read |
| 3 | Length=0, `Buffer.Pointer=NULL` | kernel panic at `acpi_hp_exec_wmi_command+0xad` (fault 0x4) from the sysctl read |

The read path is the REAL one: userland `sysctl hw.acpi.hp.*` → real
`acpi_hp_sysctl` → verbatim `acpi_hp_exec_wmi_command`.

## Build

    sh build.sh          # baseline kernel
    sh build.sh fixed    # applies the DF-2384 length-check hunk

## Run

    sh run.sh

Baseline success criteria: mode 1 prints `1094795585` (also as `maxx`),
mode 2 prints `-1`, mode 3 panics (full block in `panic.txt`). Fixed:
modes 1-3 → `-22`, mode 0 bit-identical, no panic.

## Fix

`fix.diff` (git-apply-able, A/B validated): require
`obj->Buffer.Length >= 3 * sizeof(UINT32)` before indexing `result[]`.