# VERDICT — DF-4261

**Status: untested (Info-severity hardening finding; not PoC-verified per
audit policy for Info findings). Confidence in the code defect: certain.**

## Code-path proof

`acpi_pst_attach()` allocates the _PCT control register via
`acpi_pst_alloc_resource()` (sys/dev/acpica/acpi_cpu_pstate.c:500), which on
success stores a live `struct resource *` in `sc->pst_creg.pr_res` and burns a
`rid` from `sc->pst_parent->cpu_next_rid` (acpi_cpu_pstate.c:1508-1516). From
that point on, every error return leaves the resource(s) allocated:

| path | trigger (BIOS-craftable) | leaked |
|---|---|---|
| :512-515 | status GAS element is not a ≥15-byte Buffer (`acpi_PkgRawGas` EINVAL, sys/dev/acpica/acpi_package.c:120-128) | pst_creg |
| :533-547 | _PSS evaluation fails after _PCT succeeded | both |
| :551-555 | _PSS not a package / 0 elements (`ACPI_PKG_VALID(obj,1)`) | both |
| :570-575 | _PSS entry count differs from the BSP's | both |
| :589-595, :596-604, :605-611 | per-entry package <6 elements / non-Integer element / freq bit31 set | both |
| :688-690 | _PPC object is not an Integer (eval_ppc ENXIO) | both |
| :734-736 | _PDL object is not an Integer (eval_pdl ENXIO) | both |

The device never attaches on these paths, so nothing ever releases
`pr_res`; the `rid` counter in the parent `acpi_cpu_softc` is also consumed.
Attacker model: whoever controls the ACPI namespace (firmware image,
`loader`-injected DSDT/SSDT) — i.e., already-privileged at boot. Hence Info.

Not runtime-verified: exercising it would require injecting a crafted SSDT
(Processor + _PCT with a valid SystemIO GAS + _PSS/_PPC/_PDL that then fail
validation) via QEMU `-acpitable`; the audit guest's firmware exposes no
_PSS/_PCT at all (verified live: `dev.cpu.0` carries no freq/px nodes, and
`hw.acpi.cpu.*` exposes only C-state knobs), so there is no in-guest surface
to observe the leak on without building custom AML, which the policy for
Info findings does not warrant.

## Fix
`fix.diff` (authored, not compile-validated — mechanical goto-fail refactor):
`acpi_pst_release_resource()` releases `pr_res` using the resource type
derived from `pr_gas.SpaceId` (mirroring `acpi_bus_alloc_gas`,
sys/dev/acpica/acpi.c:1261-1270), called from a new `failed:` label covering
all post-_PCT error returns, and directly on the status-register failure path.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.