# DF-2591 — PoC verdict

**File:** `sys/dev/acpica/acpi_panasonic/acpi_panasonic.c` (:231, assert at :374)

**Verdict:** **REPRODUCED** — `acpi_panasonic_shutdown()` calls
`hkey_sound_mute()` without `ACPI_SERIAL_BEGIN(panasonic)`; the callee
opens with `ACPI_SERIAL_ASSERT(panasonic)` (:374) which expands to
`KKASSERT(lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE)`
(`sys/dev/acpica/acpivar.h:172`) — a **guaranteed panic on INVARIANTS
kernels at every shutdown/reboot** of a system with this device, plus
an unsynchronized SSET evaluation racing concurrent sysctl/notify on
production kernels. Both triggers verified through the real code path;
fixed build shuts down cleanly (A/B validated).

## Line-accurate confirmation

1. `acpi_panasonic.c:222-233` — `acpi_panasonic_shutdown`:
   `sc = device_get_softc(dev); mute = 1; hkey_sound_mute(sc->handle,
   HKEY_SET, &mute);` — no `ACPI_SERIAL_BEGIN` anywhere in the
   function; every other caller path takes the serial
   (`acpi_panasonic_sysctl` :248/:262, `acpi_panasonic_notify` :487/
   :492, `acpi_panasonic_power_profile` :509/:512).
2. `acpi_panasonic.c:370-374` — `hkey_sound_mute` opens with
   `ACPI_SERIAL_ASSERT(panasonic)`.
3. `sys/dev/acpica/acpivar.h:172` — the assert is a plain `KKASSERT`
   (unconditional in the header), active on INVARIANTS kernels.
4. Reboot chain: root `reboot` → `boot()` → module `MOD_SHUTDOWN` →
   `device_shutdown(root_bus)` (`sys/kern/subr_bus.c:3549-3551`) →
   `bus_generic_shutdown` (:2883-2890) → `DEVICE_SHUTDOWN` dispatch
   (`device_shutdown`, :2154-2162) → verbatim
   `acpi_panasonic_shutdown`.

## Mechanical verification

Same rig as DF-2386 (see that VERDICT). Two real triggers:

- **A — `device_shutdown(dev)`** (the same subr_bus dispatch the
  reboot path uses; `hw.panasim.cmd=9` runs it in the rig worker):

```
panic: assertion "lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE" failed in hkey_sound_mute at /usr/src/sys/dev/acpica/panasim/acpi_panasonic_verbatim.c:374
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdd659(%rip)
```

  The KKASSERT names the lock, the function, and line 374 of the
  verbatim file (path proves the assertion fired inside the verbatim
  driver code).

- **B — real `reboot` end-to-end** (root), full backtrace captured
  (`panic_reboot.txt`):

```
boot() called on cpu#2
Switching to cpu #0 for shutdown
...
syncing disks... done
panic: assertion "lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE" failed in hkey_sound_mute at ...acpi_panasonic_verbatim.c:374
Trace beginning at frame ...
hkey_sound_mute() at hkey_sound_mute+0xb9
acpi_panasonic_shutdown() at acpi_panasonic_shutdown+0x23
bus_generic_shutdown() at bus_generic_shutdown+0x53
acpi_shutdown() at acpi_shutdown+0x9
bus_generic_shutdown() at bus_generic_shutdown+0x53
Debugger("panic")
```

  Exactly the claimed path: reboot → acpi bus shutdown → device
  shutdown → mute → assert. The panic fires mid-shutdown after disks
  synced (a recursive-panic-prone moment, as the finding notes).

## Reachability / privesc assessment (honest)

- Hardware precondition: Panasonic `MAT0019` firmware. Trigger:
  **root** `reboot`/`halt` (PR:H in the CVSS) — on an INVARIANTS
  kernel with this driver attached, the assert fires on EVERY
  shutdown (deterministic, no race needed).
- Production (non-INVARIANTS) kernels: the assert compiles out; the
  residual defect is `acpi_panasonic_sset` (SSET evaluation) running
  unlocked against concurrent sysctl/notify holders of the serial —
  a real but narrow protocol violation (CWE-667).
- Impact: panic/DoS at shutdown; no memory corruption; not a privesc.
  Low severity upheld.

## Fix validation (A/B)

Fixed kernel (#6), fix.diff hunk wrapping the mute in
`ACPI_SERIAL_BEGIN/END`:

- trigger A: rig ring records `worker: device_shutdown returned
  (no assert fired)` (`run_fixed.log`);
- trigger B: root `reboot` → clean shutdown, `grep -c panic` over the
  full serial log = 0, guest cycles and returns on its own.

## Artifacts

`run_fixed.log`, `panic_reboot.txt` (trigger B, full assert +
backtrace), `serial.txt` (fixed-run serial), rig sources,
`build.sh`/`run.sh`, `build.log`, `fix.diff`, `env.txt`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.