{
 "finding_id": "DF-2395",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "Rig could not complete a clean capture: the verbatim aibs attach with the interposed empty-?SIF reply wedged the harness guest before any o[0] read was logged (both canary mode and page-edge mode; the wedge is a rig/interposition failure, not the production behavior), and the page-edge proof technique was separately unavailable because the DFly kernel_map is densely mapped (no unmapped neighbor found for kmem_alloc pages). Source analysis is airtight: aibs_attach_sif dereferences o = bp->Package.Elements then o[0].Type with no Count check (atk0110.c:169-171) and for Package(0){} ACPICA sets Elements past the allocation - a heap OOB read whose value steers the driver. Duplicate of DF-2006 as noted. fix.diff (Count<1 check) compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log (aibsim mode=1/2 attach attempts, guest wedge before read logged); source trace VERDICT.md",
 "kernel_refs": [
  "sys/dev/acpica/aibs/atk0110.c:169",
  "sys/dev/acpica/aibs/atk0110.c:170",
  "sys/dev/acpica/aibs/atk0110.c:171"
 ],
 "poc_changes": "aib_shim.c verbatim-interposition harness written for this batch (AcpiEvaluateObjectTyped interposer with canary/page-edge empty-package modes); rig wedge prevented the capture",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}