{
 "finding_id": "DF-2393",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "In-flight-window choreography executed (Notify(TOS0,0x80) handler blocked 2.5s inside the rigged GHCI AML; toshiba softc freed (48-byte zone, verified size) and canary-sprayed mid-flight, twice, including a 64-chunk manual respray) but no fault materialized: the freed chunk is recycled by the ACPICA allocations of the resuming evaluation itself, so sc->video_handle reads a mapped-but-stale pointer and the wild AcpiEvaluateObject fails gracefully. Same missing-drain root as DF-2381 (which DID panic with the blocker choreography - there nothing ran between free and use); the toshiba handler unavoidably performs further allocations before the sc deref, laundering the canary. Source-certain: acpi_toshiba_notify derefs sc (hci_key_action sc->video_handle at acpi_toshiba.c:497) and detach frees the softc with no drain.",
 "exploit_chain": "",
 "evidence": "run.log (console narration: TMD1; NTF; softc freed mid-_HCI; no trap after 20s, three attempts with correct 48-byte zone spray)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:497",
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:269",
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:273",
  "sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219"
 ],
 "poc_changes": "AML-sleep choreography (run_tosfreed) written for this batch; softc size measured at runtime (48 bytes, zone 64) after a wrong-zone first attempt",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}