# DF-2393 VERDICT

**Status:** not_reproduced
**Impact:** panic
**Confidence:** likely
**Attempts:** 3

In-flight-window choreography executed (Notify(TOS0,0x80) handler blocked 2.5s inside the rigged GHCI AML; toshiba softc freed (48-byte zone, verified size) and canary-sprayed mid-flight, twice, including a 64-chunk manual respray) but no fault materialized: the freed chunk is recycled by the ACPICA allocations of the resuming evaluation itself, so sc->video_handle reads a mapped-but-stale pointer and the wild AcpiEvaluateObject fails gracefully. Same missing-drain root as DF-2381 (which DID panic with the blocker choreography - there nothing ran between free and use); the toshiba handler unavoidably performs further allocations before the sc deref, laundering the canary. Source-certain: acpi_toshiba_notify derefs sc (hci_key_action sc->video_handle at acpi_toshiba.c:497) and detach frees the softc with no drain.

## Kernel references
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:497`
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:269`
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:273`
- `sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.