# DF-2395 VERDICT

**Status:** inconclusive
**Impact:** corruption
**Confidence:** likely
**Attempts:** 2

Rig could not complete a clean capture: the verbatim aibs attach with the interposed empty-?SIF reply wedged the harness guest before any o[0] read was logged (both canary mode and page-edge mode; the wedge is a rig/interposition failure, not the production behavior), and the page-edge proof technique was separately unavailable because the DFly kernel_map is densely mapped (no unmapped neighbor found for kmem_alloc pages). Source analysis is airtight: aibs_attach_sif dereferences o = bp->Package.Elements then o[0].Type with no Count check (atk0110.c:169-171) and for Package(0){} ACPICA sets Elements past the allocation - a heap OOB read whose value steers the driver. Duplicate of DF-2006 as noted. fix.diff (Count<1 check) compile-validated.

## Kernel references
- `sys/dev/acpica/aibs/atk0110.c:169`
- `sys/dev/acpica/aibs/atk0110.c:170`
- `sys/dev/acpica/aibs/atk0110.c:171`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.