=== DF-2384 baseline runs (HPHARNESS kernel #6, verbatim acpi_hp.c) ===
(root) sysctl hw.hpsim.cmd=1            # create fake acpi_wmi bus + acpi_hp0
acpi_hp0: HP event GUID detected, installing event handler
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi39 + acpi_hp0 (sc=0xfffff80117addb80)
(sysctls now live at hw.acpi.hp.* under the REAL hw.acpi tree, exactly
as on HP hardware)

--- mode 0: conformant 12-byte reply (control) ---
(root)      sysctl hw.acpi.hp.display     -> hw.acpi.hp.display: 683
            sysctl hw.acpi.hp.hdd_temperature -> 683
(maxx/unprivileged)
            sysctl hw.acpi.hp.display     -> 683
            sysctl hw.acpi.hp.hdd_temperature -> 683

--- mode 1: BIOS reply declared Length=4, canaries at +4 (0x41414141)
    and +8 (0x42424242) past the declared buffer ---
(root)      sysctl hw.acpi.hp.display     -> hw.acpi.hp.display: 1094795585
            sysctl hw.acpi.hp.hdd_temperature -> 1094795585
(maxx)      sysctl hw.acpi.hp.display     -> 1094795585
        1094795585 = 0x41414141 = the canary at result[1] (declared+4..+8):
        acpi_hp_exec_wmi_command read past Buffer.Length=4 and returned
        the out-of-bounds word to USERLAND through an unprivileged sysctl.

--- mode 2: BIOS reply declared Length=4, tight allocation; INVARIANTS
    debug.use_malloc_pattern=1 (-1 fill) ---
(root)      sysctl hw.acpi.hp.display     -> hw.acpi.hp.display: -1
            sysctl hw.acpi.hp.hdd_temperature -> -1
        -1 = 0xffffffff = the uninitialized tail of the allocation beyond
        the 4 declared bytes: reads at declared+4..+12 return heap bytes
        the driver does not own per the ACPI object contract.

--- mode 3: BIOS reply declared Length=0 with Buffer.Pointer=NULL ---
(root)      sysctl hw.acpi.hp.display ->
Fatal user address access from kernel mode from sysctl at ffffffff80a173ed
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x4
instruction pointer	= 0x8:0xffffffff80a173ed
panic: page fault
acpi_hp_exec_wmi_command() at acpi_hp_exec_wmi_command+0xad 0xffffffff80a173ed
acpi_hp_sysctl() at acpi_hp_sysctl+0x44 0xffffffff80a183b4
        Kernel PANIC from a world-readable sysctl: the unchecked
        result[] indexing dereferences the NULL Buffer.Pointer.
        (full serial block in panic.txt)

=== DF-2384 fixed-kernel runs (HPHARNESS kernel #11: fix.diff length
    check `Buffer.Length < 3 * sizeof(UINT32)` -> -EINVAL) ===
mode 0:  hw.acpi.hp.display = 683   (bit-identical to baseline)
mode 1:  hw.acpi.hp.display = -22   (EINVAL: short reply rejected)
mode 2:  hw.acpi.hp.display = -22
mode 3:  hw.acpi.hp.display = -22   (NO PANIC; repeat also -22)
mode 0 again: 683; unprivileged (maxx) read: 683
GUEST-STILL-UP