# DF-3795 VERDICT

## Status: not_reproduced on this guest — code-certain by trace; no _PRW in guest firmware

**Guest:** QEMU-emulated DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC).

## Why not reproduced at runtime

`acpidump -b -n DSDT && iasl -d` on the guest: its DSDT contains **zero
`_PRW` objects** (`grep -c _PRW dsdt.dsl` → 0). The mis-parse only fires
for `_PRW` packages with `Count > 2` (i.e. wake-capable devices listing
power resources). Exercising it requires different firmware, not different
userspace — a guest-runtime proof is impossible on this DSDT, so the
honest status is `not_reproduced` rather than a forced demonstration.

## Why the code defect is certain

* The function's own comment (acpi.c:2962) states elements **2 to N** are
  the power resources; the loop at acpi.c:2969-2970 copies
  `Elements[i]` for `i in [0, power_count)`, i.e. elements **0 to
  Count-3**.
* ACPI spec semantics of `_PRW`: elem0 = GPE indicator (INTEGER or
  PACKAGE), elem1 = lowest wake sleep state, elem2.. = power-resource
  references.
* Consumer path is type-safe — `acpi_pwr_reference_resource()`
  (acpi_powerres.c:582) → `acpi_GetReference()` (acpi_package.c:132-160)
  returns NULL for INTEGER/PACKAGE elements — so elements 0/1 are dropped,
  and with Count==3 the single genuine power resource at element 2 is
  never referenced. Effect: `acpi_wake_sleep_prep` (acpi.c:2752-2754)
  never turns on the device's wake power rails; `acpi_wake_run_prep`
  (acpi.c:2789-2790) never cleans them. Availability/functional impact on
  wake-capable hardware; no memory-safety impact.
* Cross-check: FreeBSD main has the identical line
  (`freebsd-src/sys/dev/acpica/acpi.c` ~4117: `Elements[i]`) — inherited
  MI bug, not a DFly divergence.

## Fix validation

`fix.diff` (`Elements[i + 2]`) was compiled into the patched test kernel
together with the DF-3793/DF-3794 fixes (one-line change; the affected
branch is unreachable on this guest's firmware), so runtime behavioral
validation of this specific change is honestly `not_testable` here; the
index arithmetic is self-evident against the comment and the consumer.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.