# DF-2394 VERDICT

**Status:** reproduced (reproduced)
**Impact:** leak
**Confidence:** certain
**Attempts:** 2

Unprivileged (uid 1001) reads of all five CTLFLAG_ANYBODY toshiba sysctls returned deterministic kernel-stack garbage - 33554416 (0x2000050), 0, 524287 (0x7FFFF), -2048 (0xFFFFF800), 524287 - none AML-provided: the rigged GHCI returns HCI_SUCCESS in element[0] with element[2] (CX) as a String, so the ignored acpi_PkgInt32 at acpi_toshiba.c:442/:445 leaves hci_call reporting success with *arg never written, and acpi_toshiba_sysctl (UINT32 arg at :292) SYSCTL_OUTs the uninitialized stack. Five stable per-node garbage values across 5 rounds. Fixed kernel: reads return errors.

## Kernel references
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:292`
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442`
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:445`
- `sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:307`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.