{
  "finding_id": "DF-4286",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "use-after-free of acpi_thinkpad softc (read/write + AcpiEvaluateObject with handles loaded from freed memory) racing kldunload/devctl-detach against /dev/led/thinklight toggles; root-only, hardware-gated",
  "confidence": "likely",
  "verdict": "thinkpad_led() queues thinkpad_led_task via AcpiOsExecute with no lifetime tie to the driver; acpi_thinkpad_detach() waits only inside led_destroy() for the led(4) cdev refs, then returns and the softc is freed while the queued task can still run acpi_thinkpad_sysctl_set(sc,...) on it. Sensors-side unregister is properly serialized (sensor thread holds its lock across func), the LED side is not. Cannot be staged on this guest (driver probes only on IBM0068/LEN0068/LEN0268 ACPI hardware); module build on guest verified clean.",
  "exploit_chain": "root: thread A loops writes to /dev/led/thinklight (queues thinkpad_led_task, sets led_busy); thread B kldunload acpi_thinkpad -> detach -> led_destroy (waits cdev only) -> softc freed -> task executes ACPI_SERIAL_BEGIN + sysctl_set on freed sc -> UAF read/write + AML eval with freed handles -> panic/corruption (root-triggered)",
  "evidence": "VERDICT.md proof chain with acpi_thinkpad.c:390-416 vs 659-660 and led.c:319-340; contrast kern_sensors.c:238-250 (safe pattern)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:390-416",
    "sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:634-663",
    "sys/dev/misc/led/led.c:319-340"
  ],
  "poc_changes": "no seed; not runtime-testable on this guest (no ThinkPad ACPI node)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "acpi_thinkpad.ko module build verified compiling cleanly on the guest during this run (reachability sanity). classified inconclusive/hw-gated per house style.",
  "recommended_fix": "drain in-flight thinkpad_led_task in detach: after led_destroy, tsleep on sc->led_busy until cleared (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable: race requires ThinkPad hardware absent from this guest. fix.diff drains the async task before softc teardown; matches the sensors-side serialization pattern already used by this driver.",
  "fix_evidence": "source-level: fix.diff vs acpi_thinkpad.c:659-660 and 415"
}