{
 "finding_id": "DF-2385",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "acpi_PkgInt(res, idx=Count) returned the planted past-the-end element (0xCAFEF00DBAADC0DE) to the caller - the Elements[idx] dereference has no bounds check and the obj==NULL guard is dead code (address-of never NULL). Control idx=0 returned the in-bounds value 0x1111111111111111. All 36 in-tree callers currently pre-validate with ACPI_PKG_VALID, so firmware-triggerability requires a companion driver bug (as filed). Fixed kernel returns EINVAL for idx==Count with dst untouched (0xdeadbeef...).",
 "exploit_chain": "any caller that passes an unchecked idx obtains kernel heap contents adjacent to the Elements array as a returned integer - per-call kernel heap disclosure into driver state",
 "evidence": "run.log (control idx=0 -> 0x1111111111111111; idx=2==Count -> 0xcafef00dbaadc0de VERDICT BUG REPRODUCED); fixed.log (idx=2 -> error=22 val=0xdeadbeefdeadbeef)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_package.c:45",
  "sys/dev/acpica/acpi_package.c:49",
  "sys/dev/acpica/acpi_package.c:73",
  "sys/dev/acpica/acpi_package.c:124"
 ],
 "poc_changes": "rig ops pkg_oob_canary / pkg_oob_heap written for this batch; page-edge variant unavailable (kernel_map densely mapped)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}