# DF-2385 VERDICT

**Status:** reproduced (reproduced)
**Impact:** leak
**Confidence:** certain
**Attempts:** 2

acpi_PkgInt(res, idx=Count) returned the planted past-the-end element (0xCAFEF00DBAADC0DE) to the caller - the Elements[idx] dereference has no bounds check and the obj==NULL guard is dead code (address-of never NULL). Control idx=0 returned the in-bounds value 0x1111111111111111. All 36 in-tree callers currently pre-validate with ACPI_PKG_VALID, so firmware-triggerability requires a companion driver bug (as filed). Fixed kernel returns EINVAL for idx==Count with dst untouched (0xdeadbeef...).

## Kernel references
- `sys/dev/acpica/acpi_package.c:45`
- `sys/dev/acpica/acpi_package.c:49`
- `sys/dev/acpica/acpi_package.c:73`
- `sys/dev/acpica/acpi_package.c:124`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.