# DF-2590 — PoC evidence pack

**Finding:** `acpi_panasonic_hkey_event()` calls `AcpiEvaluateObject`
for `HINF` and immediately dereferences `res = buf.Pointer` without
checking status or NULL
(`sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:403-405`). Triggered
by an ACPI notify `0x80` (Panasonic Fn hotkey) when the evaluation
fails. The late `if (buf.Pointer) AcpiOsFree` at :420-421 shows the
author knew the pointer can be NULL — one check too late.

## Rig

Same verbatim-interposition kernel harness as DF-2386 (see that
README). The real attach's
`AcpiInstallNotifyHandler(acpi_panasonic_notify, sc)` is captured by
the interposer; `hw.panasim.cmd=3` dispatches notify `0x80` to the
captured **real** verbatim handler exactly the way ACPICA's deferred
notify thread would. `hw.panasim.hinf_mode` selects the HINF reply
(`1` = integer happy path, `0` = evaluation failure, buffer untouched).

## Build

```
sh build.sh            # shared with DF-2386
```

## Run

```
sh run.sh              # happy-path notify, then armed failure -> panic
```

## Expected result (baseline)

- happy path (`hinf_mode=1`, HINF integer `0x81`): full verbatim notify
  path runs — key 1 decode, brightness action (SSET observed), real
  `acpi_UserNotify` fires — no panic;
- armed (`hinf_mode=0`): injected notify → kernel panic (fatal trap in
  `acpi_panasonic_hkey_event`, fault va 0x0), captured in `panic.txt`.
- fixed build: device_printf "HINF evaluation failed", no panic.