{
 "finding_id": "DF-2394",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Unprivileged (uid 1001) reads of all five CTLFLAG_ANYBODY toshiba sysctls returned deterministic kernel-stack garbage - 33554416 (0x2000050), 0, 524287 (0x7FFFF), -2048 (0xFFFFF800), 524287 - none AML-provided: the rigged GHCI returns HCI_SUCCESS in element[0] with element[2] (CX) as a String, so the ignored acpi_PkgInt32 at acpi_toshiba.c:442/:445 leaves hci_call reporting success with *arg never written, and acpi_toshiba_sysctl (UINT32 arg at :292) SYSCTL_OUTs the uninitialized stack. Five stable per-node garbage values across 5 rounds. Fixed kernel: reads return errors.",
 "exploit_chain": "unprivileged 4-byte kernel stack disclosure per node read on Toshiba HCI firmware that returns a non-integer CX with success status (faulty or attacker-supplied ACPI tables)",
 "evidence": "run.log (5 nodes x 5 rounds: 33554416/0/524287/-2048/524287, uid=1001); fixed.log (reads return errors)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:292",
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442",
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:445",
  "sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:307"
 ],
 "poc_changes": "no PoC existed; sysctl sweep written for this batch",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}