# DF-2387 — PoC evidence pack

**Finding:** `acpi_panasonic_sinf()` indexes
`res->Package.Elements[index]` without checking
`index < res->Package.Count`
(`sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:280`). Registers
`0x02..0x08` are read assuming the firmware SINF package always has
≥ 9 elements; a short/malformed package makes the read run past what
the firmware declared, and the value flows back to userspace through
the `CTLFLAG_ANYBODY` sysctl (kernleak class).

## Rig

Same verbatim-interposition kernel harness as DF-2386 (see that README;
`panasim.c`/`pana_shim.c`/`build.sh` are identical). The SINF reply is
runtime-selectable via `hw.panasim.sinf_mode`:

- `4` = sane 9-element package (control),
- `1` = **canary**: `Package.Count=2` with a 9-element backing store
  where elements past `Count` hold per-index canaries `0xC2…`, `0xC3…`,
  `0xC4…`, `0xC8…` — a returned canary proves the read ignored Count,
- `2` = **tight**: `Count=2` with only a 2-element allocation — the
  read lands past the `kmalloc` and discloses adjacent kernel heap
  memory to the unprivileged reader.

## Build

```
sh build.sh            # shared with DF-2386 (baseline PANHARNESS kernel)
```

## Run

```
sh run.sh              # canary proof + tight-mode leak samples (maxx reads)
```

## Expected result (baseline)

- canary mode: `maxx` reads return exactly the per-register canary
  (`reg2→0xC2C2C2C2`, `reg3→0xC3…`, `reg4→0xC4…`, `reg8→0xC8…`,
  truncated to UINT32) — the value that reaches userspace identifies
  the exact out-of-package index that was read;
- tight mode: non-deterministic adjacent-heap values (leak samples in
  `tight_run.txt`), no panic (reads stay inside mapped slab memory);
- fixed build: every short-package read returns `-1` (index guard).