# DF-3794 VERDICT

## Status: reproduced (measured kernel heap leak, gated on root + tunable)

**Guest:** DragonFly dfbsd 6.5-DEVELOPMENT (X86_64_GENERIC) with
`debug.acpi.allow_method_calls=1` (loader tunable), `/dev/acpi` mode
`crw-r--r-- root:wheel` (ioctl needs `FWRITE` ⇒ root).

## What was run

`mcallleak.c` (this pack): 2-INTEGER argument list, `path = (char *)0x10`
so `copyinstr` faults *after* `acpi_copyin_object_list()` succeeded.
`mcallctrl.c`: identical ioctl with a valid path (control).

Measured with `vmstat -m | grep acpica` (M_ACPICA type, InUse bytes):

```
baseline                                       46 allocs    6.39K
+100,000  faulted calls (1st session)       97.7K allocs    6.11M
+1,000,000 faulted calls                  1.05M allocs   67.1M
+100,000  faulted calls (2nd session)      1.14M allocs   73.2M
+ 20,000  valid-path control calls         1.14M allocs   73.2M  <- unchanged
```

Exactly 64 bytes/call (16 + 2×24 = `sizeof(ACPI_OBJECT_LIST)` + 2
`ACPI_OBJECT`s), unbounded, seconds for a million iterations ⇒
memory-exhaustion DoS available to any process holding /dev/acpi
`O_RDWR` when the debug tunable is enabled. Control run leaks nothing,
isolating the leak to the `copyinstr` failure return at acpi.c:3356-3357.

## Impact ceiling

`dos` (kernel heap exhaustion). Not memory corruption; not reachable
unprivileged (FWRITE gate acpi.c:3427 + boot tunable acpi.c:3459).

## Exploit chain

n/a (resource leak; privileged+debug-gated).

## Fix validation

`fix.diff` (free `args` before the EINVAL return) applied in the guest's
`/usr/src`, kernel rebuilt and booted; the same `mcallleak 100000` run
then showed **zero growth** of M_ACPICA InUse. See `run_patched.log`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.