# DF-2591 — PoC evidence pack

**Finding:** `acpi_panasonic_shutdown()` calls `hkey_sound_mute()`
without `ACPI_SERIAL_BEGIN(panasonic)`
(`acpi_panasonic.c:231`); `hkey_sound_mute()` opens with
`ACPI_SERIAL_ASSERT(panasonic)` (:374) which expands to
`KKASSERT(lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE)`
(`sys/dev/acpica/acpivar.h:172`) — guaranteed panic on INVARIANTS
kernels at every shutdown/reboot of a system with this device.

## Rig

Same verbatim-interposition kernel harness as DF-2386 (see that
README). Two real triggers:

- **A (`run.sh baseline cmd`)**: `hw.panasim.cmd=9` makes the rig
  worker call `device_shutdown(dev)` — the same subr_bus dispatch
  (`sys/kern/subr_bus.c:2154-2162`) the reboot path uses for every
  device (`MOD_SHUTDOWN` → `device_shutdown(root_bus)` →
  `bus_generic_shutdown`, subr_bus.c:3549-3551, :2883-2890).
- **B (`run.sh baseline reboot`)**: root `reboot` end-to-end.

## Build

```
sh build.sh            # shared with DF-2386
```

## Run

```
sh run.sh baseline cmd      # trigger A: device_shutdown -> assert panic
sh run.sh baseline reboot   # trigger B: real reboot -> assert panic
sh run.sh fixed   cmd|reboot  # fixed: no assert; clean shutdown
```

## Expected result (baseline)

KKASSERT panic naming the panasonic serial (lockstatus ≠ LK_EXCLUSIVE)
inside `acpi_panasonic_shutdown`→`hkey_sound_mute`, on the INVARIANTS
stock-style kernel. Fixed build: no assert, device_shutdown returns,
reboot completes cleanly.