# DF-2589 — PoC verdict

**File:** `sys/dev/acpica/acpi_panasonic/acpi_panasonic.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

acpi_panasonic_sinf() calls AcpiEvaluateObject("SINF") without checking the ACPI_STATUS return; on failure buf.Pointer is NULL and res->Type (line 279) is a guaranteed NULL-deref panic. Even on success, line 280 reads res->Package.Elements[index] with no Package.Count check (OOB heap read if the package has fewer than index+1 elements). Reachable via four CTLFLAG_ANYBODY sysctl nodes.

### Cited lines

- `sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:277-280`

## Why it does not reproduce on this guest

No Panasonic ACPI SINF device on the QEMU/BOCHS guest (sysctl hw.acpi.panasonic -> unknown oid; module not loaded).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Check ACPI_FAILURE(status) and return early; validate res!=NULL, res->Type==ACPI_TYPE_PACKAGE, and index<res->Package.Count before the element access.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)