# DF-2395 - aibs zero-element SIF package OOB read: RIG-INCOMPLETE

## Attempt (aib_shim.c: verbatim atk0110.c + interposed
AcpiEvaluateObjectTyped returning Package(0){} with Elements either in
canary-sprayed padding or at an unmapped page edge)
Both attach attempts wedged the harness guest before the o[0].Type read
produced any log line - a rig failure (the verbatim driver attach path
interacts badly with the fake-child interposition in this kernel), not
the production behavior.

## Source (certain)
  bp = b.Pointer; o = bp->Package.Elements;   /* atk0110.c:169-170 */
  if (o[0].Type != ACPI_TYPE_INTEGER) { ...   /* :171 - OOB for Count==0 */
ACPICA UtCopyIpackageToEpackage sets Elements = buffer+sizeof(ACPI_OBJECT)
for Package(0){} - one past the allocation.

## fix.diff (compile-validated): explicit bp->Package.Count < 1 check
before the Elements[0] dereference. Duplicate of DF-2006.