# DF-2388 - Verification Verdict

**Status:** not_reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
acpi_panasonic_detach unregisters the notify handler (AcpiRemoveNotifyHandler) and immediately frees the sysctl ctx / returns; in-flight ACPI notifies dispatched on the acpi_task helper can still be running acpi_panasonic_notify against the freed softc. DragonFly AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219) - proven drain-less by the verified sibling DF-2381 (acpi_fujitsu UAF panic, same class).

## Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Panasonic _HID ACPI hardware absent in the QEMU guest; class behavior already runtime-proven by DF-2381 (fatal trap on freed+sprayed softc).

## Threat / reachability
Requires the named hardware/module; see VERDICT.md.

## Privilege escalation assessment
n/a (device-gated)

## Fix
Implement a real AcpiOsWaitEventsComplete (DF-2381 fix.diff: pending-count + drain in OsdSchedule.c) and call it in detach after removing the handler.

## Kernel references
- `sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:212`
- `sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.