{
  "finding_id": "DF-2384",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Missing Buffer.Length check confirmed line-accurate (acpi_hp.c:848-856 checks only the object type before indexing result[1]/result[2]) and mechanically with the verbatim acpi_hp.c running under the interposed WMI harness: a BIOS reply declared Length=4 made the driver return the 0x41414141 canary planted at declared+4..+8 to USERLAND through the world-readable hw.acpi.hp.* sysctls (read as unprivileged maxx, value 1094795585), a tight 4-byte reply surfaced the uninitialized allocation tail (0xffffffff with debug.use_malloc_pattern=1), and a zero-length reply with NULL Buffer.Pointer panicked the kernel at acpi_hp_exec_wmi_command+0xad from a sysctl read (Fatal trap 12, fault 0x4). Impact is firmware-gated (the BIOS controls the reply object): up to 8 OOB heap bytes leaked per unprivileged sysctl read plus a reliable NULL-deref DoS; no attacker-controlled write, no privesc. Fix (require >= 12 bytes, else -EINVAL) A/B validated: modes 1-3 return -22 with no panic, conformant 12-byte replies bit-identical.",
  "exploit_chain": "unprivileged local user on HP WMI hardware with a short-reply BIOS: sysctl hw.acpi.hp.<any value node> -> acpi_hp_sysctl -> acpi_hp_exec_wmi_command indexes result[2] (+8..+12) and result[1] (+4..+8) of a reply buffer declared 4 bytes (or 0 bytes) -> 8 bytes past the ACPI object surface to userland per read; zero-length+NULL reply instead panics the kernel (DoS). Ceiling: kernel heap info leak + firmware-gated DoS; no write primitive.",
  "evidence": "run.log (mode0=683 control; mode1=1094795585 root AND unprivileged maxx; mode2=-1 pattern tail; mode3 panic; fixed: -22 x3, mode0 identical, guest up); panic.txt (full serial: Fatal trap 12 fault 0x4 at acpi_hp_exec_wmi_command+0xad <- acpi_hp_sysctl+0x44, Fatal user address access from kernel mode from sysctl); hp_sim.c (interposed evaluate_call reply modes); fix.diff (length check); env.txt",
  "kernel_refs": [
    "sys/dev/acpica/acpi_hp/acpi_hp.c:828-860",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:847-851",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:852-856",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:635-732",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:707-722"
  ],
  "poc_changes": "No seed PoC existed; reused the verbatim-interposition kernel harness built for DF-2383 (same kernel, same hp_sim.c): the interposed acpi_wmi_evaluate_call returns ACPI_TYPE_BUFFER objects with controllable Buffer.Length and Buffer.Pointer plus canary tails; the read path is the REAL sysctl (hw.acpi.hp.* created by the verbatim attach under the real hw.acpi tree), exercised from both root and an unprivileged user.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #11: Mon Oct 19 07:18:02 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/HPHARNESS  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh        # baseline HPHARNESS kernel (same as DF-2383);  sh build.sh fixed  # applies the DF-2384 length-check hunk",
  "run_cmd": "sh run.sh          # hw.hpsim.cmd=1 create; hw.hpsim.reply_mode 0..3 + sysctl hw.acpi.hp.display reads (incl. su -m maxx)",
  "code_hash": "f241473f5ec4e5efb82a736f39c1f7216a955f2622b010f7f7ef17657f2620aa",
  "notes": "Firmware-gated: the kernel trusts the BIOS reply object shape; the sysctl surface itself is unprivileged. Zero-length-buffer NULL-pointer variant recorded as the same root cause (panic.txt). Same guest/kernel as DF-2383; see DF-2383 pack for the full build story (nativekernel, sha256 gate, worker-kthread command plane).",
  "recommended_fix": "In acpi_hp_exec_wmi_command require obj->Buffer.Length >= 3 * sizeof(UINT32) before indexing result[], returning -EINVAL otherwise"
}