{
 "finding_id": "DF-2391",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Unprivileged (uid 1001) reads of every optional acpi_sony sysctl node returned the stale kernel-stack int: brightness (getmethod GBRT present) returned the real 7 while all 8 nodes whose getmethods are absent returned -1 across 3 rounds - 4 bytes of uninitialized kernel stack per read, exactly as filed (val declared uninitialized at acpi_sony.c:183, acpi_GetInteger failure ignored at :185, sysctl_handle_int SYSCTL_OUTs it verbatim). Fixed kernel: missing getmethod -> sysctl read returns an error, no value disclosed.",
 "exploit_chain": "unauthenticated-to-host local unprivileged kernel stack disclosure (4 bytes per node read; repeated reads with different preceding sysctl activity vary the leaked residue)",
 "evidence": "run.log (brightness 7 vs contrast/bass_gain/pcr/wdp/cdp/azp/lnp all -1, x3 rounds, uid=1001); fixed.log (contrast read returns error; brightness still 7)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_sony/acpi_sony.c:179",
  "sys/dev/acpica/acpi_sony/acpi_sony.c:183",
  "sys/dev/acpica/acpi_sony/acpi_sony.c:185",
  "sys/dev/acpica/acpi_sony/acpi_sony.c:187"
 ],
 "poc_changes": "no PoC existed; sysctl read sweep written for this batch",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}