{
  "finding_id": "DF-2591",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Confirmed on the verbatim driver in the DF-2386 kernel rig, through both real trigger paths. acpi_panasonic_shutdown calls hkey_sound_mute(sc->handle, HKEY_SET, &mute) with no ACPI_SERIAL_BEGIN(panasonic) anywhere in the function (acpi_panasonic.c:228-232) while every other caller path takes the serial (:248/:262, :487/:492, :509/:512); hkey_sound_mute opens with ACPI_SERIAL_ASSERT(panasonic) (:374), which expands to KKASSERT(lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE) (acpivar.h:172) and panics on INVARIANTS kernels. Trigger A (device_shutdown(dev), the same subr_bus.c:2154-2162 DEVICE_SHUTDOWN dispatch the reboot path uses) panicked with the assertion naming hkey_sound_mute and line 374 of the verbatim file. Trigger B (root reboot end-to-end) captured the full chain: boot() -> acpi_shutdown -> bus_generic_shutdown -> acpi_panasonic_shutdown+0x23 -> hkey_sound_mute+0xb9 -> assertion panic at :374 after disks synced (the recursive-panic-prone moment the finding describes). Deterministic on every shutdown of an INVARIANTS kernel with this driver attached; production non-INVARIANTS kernels compile the assert out and keep only the unsynchronized SSET evaluation racing concurrent sysctl/notify holders. Root-triggered DoS at reboot, no memory corruption, not a privesc. fix.diff (ACPI_SERIAL_BEGIN/END around the mute) A/B validated: device_shutdown returns with no assert and a real reboot completes with zero panics in the serial log.",
  "exploit_chain": "root reboot/halt -> boot() -> rootbus MOD_SHUTDOWN -> device_shutdown(root_bus) (subr_bus.c:3549-3551) -> bus_generic_shutdown (:2883-2890) -> DEVICE_SHUTDOWN -> verbatim acpi_panasonic_shutdown -> hkey_sound_mute without the panasonic serial -> ACPI_SERIAL_ASSERT KKASSERT fails (lockstatus != LK_EXCLUSIVE) -> panic mid-shutdown after disks synced. No attacker-controlled data; PR:H as scored. Rig trigger A reaches the identical dispatch via device_shutdown on the fake child for a controlled capture.",
  "evidence": "panic_reboot.txt (trigger B: assertion message naming panasonic_serial/hkey_sound_mute/verbatim line 374 plus the full backtrace acpi_panasonic_shutdown+0x23 <- bus_generic_shutdown+0x53 <- acpi_shutdown+0x9 <- bus_generic_shutdown+0x53); triggerA.txt (device_shutdown capture); run_fixed.log (trigger A: worker: device_shutdown returned (no assert fired); trigger B: clean reboot, grep -c panic over the whole serial log = 0, guest cycles back unattended)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:222-233",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:370-374",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:248",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:487-492",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:509-512",
    "sys/dev/acpica/acpivar.h:172",
    "sys/kern/subr_bus.c:3549-3551",
    "sys/kern/subr_bus.c:2154-2162",
    "sys/kern/subr_bus.c:2883-2890"
  ],
  "poc_changes": "No seed PoC existed; reused the DF-2386 rig and added worker cmd 9 (device_shutdown on the fake child -- the same kobj DEVICE_SHUTDOWN dispatch the reboot path performs) so the assert can be captured without consuming a full reboot cycle; the real reboot was then run end-to-end as trigger B on a separate boot.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #4: Mon Oct 19 09:05:52 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/PANHARNESS  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh          # shared with DF-2386 (verbatim driver + rig, PANHARNESS kernel)",
  "run_cmd": "sh run.sh baseline cmd      # trigger A: device_shutdown -> assert panic;  sh run.sh baseline reboot   # trigger B: real reboot -> assert panic mid-shutdown;  sh run.sh fixed cmd|reboot",
  "code_hash": "a70387113f982a4e39cc0daf840d67df623a06cdbcd64a5b48c1ab3aafd39ac7",
  "notes": "The stock guest kernel is INVARIANTS (config line 56 of X86_64_GENERIC, inherited by PANHARNESS), matching the finding premise. Production impact after the assert compiles out: acpi_panasonic_sset runs unlocked from shutdown racing sysctl/notify holders of the same serial -- a CWE-667 protocol violation with no demonstrated memory unsafety.",
  "recommended_fix": "acpi_panasonic_shutdown: wrap the hkey_sound_mute call in ACPI_SERIAL_BEGIN(panasonic) / ACPI_SERIAL_END(panasonic), matching every other caller"
}