# DF-2389 — PoC verdict

**File:** `sys/dev/acpica/acpi_pci_link.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

pl_links[] is sized from the number of IRQ resources counted in _CRS, but link_add_prs unconditionally walks _PRS into the same array. The only bound is a KASSERT (no-op on production/non-INVARIANTS kernels). A _PRS listing more IRQ resources than _CRS overflows pl_links[].

### Cited lines

- `sys/dev/acpica/acpi_pci_link.c:311-313`
- `sys/dev/acpica/acpi_pci_link.c:326-345`

## Why it does not reproduce on this guest

No acpi_pci_link instances with a _PRS-exceeds-_CRS mismatch on the QEMU guest: dmesg shows no pci_link attachment; the PIIX3 ACPI exposes only standard IRQ routing. The OOB requires a buggy/malicious ACPI _PRS table.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Replace the KASSERT-only guard with a real bounds check: if req->link_index >= pl_num_links, device_printf + return AE_AML_NUMERIC_OVERFLOW.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)