# DF-3795 — `acpi_parse_prw()` copies the wrong `_PRW` elements as power resources

* File: `sys/dev/acpica/acpi.c` (pass 2)
* Lines: 2962–2970 (off-by-two at 2969–2970)
* Class: CWE-682 (incorrect computation) / incorrect index
* Severity: Low (functional/availability, firmware-dependent) · Confidence: certain

## What

Per ACPI spec (and the code's own comment), `_PRW` packages are:

```
Package { <gpe>, <lowest_wake_sstate>, <power-resource ref>, ... }
          elem0    elem1                elem2 .. elemN
```

`acpi_parse_prw()` computes `power_count = Package.Count - 2` — the number
of power-resource references — but then copies **elements 0 .. count-1**
instead of **2 .. N**:

```c
    /* Elements 2 to N of the _PRW object are power resources. */
    power_count = res->Package.Count - 2;
    ...
    for (i = 0; i < power_count; i++)
	prw->power_res[i] = res->Package.Elements[i];   /* should be [i + 2] */
```

Consequences in the consumer (`acpi_powerres.c:552-556`
`acpi_pwr_wake_enable()` → `acpi_pwr_reference_resource()` →
`acpi_GetReference()`, acpi_package.c:132):

* Elements 0 and 1 are an INTEGER (GPE bit) or a PACKAGE (GPE handle+bit)
  and an INTEGER (lowest wake state). `acpi_GetReference()` type-checks and
  returns NULL for both ⇒ dropped (no memory-safety impact).
* With exactly one power resource (Count == 3) the real reference at
  element 2 is **never** copied; with more, a shifted prefix (2..Count-3)
  is used. Net effect: wake power resources are not powered on at sleep
  (`acpi_wake_sleep_prep`, acpi.c:2752-2754) nor cleaned up on wake
  (acpi.c:2789-2790), so devices whose wake depends on those rails cannot
  wake the machine (availability), and stale/extra references may keep
  rails on after resume.

This bug is inherited from FreeBSD (verified identical in
freebsd-src/main sys/dev/acpica/acpi.c ~line 4117), so it is a
long-standing MI defect, not a DFly-only divergence — but it is still a
defect in this tree.

## Guest testability

The QEMU guest's DSDT contains **no `_PRW` objects at all**
(`acpidump -b -n DSDT; iasl -d; grep -c _PRW` → 0), so the mis-parse
cannot be triggered on this guest; the verdict is code-certain but
runtime-`not_reproduced`. Hardware with wake-capable devices whose `_PRW`
lists power resources (Count > 2 — common for PCIe WOL, wake-on-lid,
 Suns/USB on laptops) is affected.

## Fix

See `fix.diff`: `prw->power_res[i] = res->Package.Elements[i + 2];`