{
 "finding_id": "DF-4406",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "NULL-pointer panic when thermal zone unit 0 fails acpi_tz_establish (malformed _ALx non-package) and a second zone attaches: the driver-global sysctl tree was never created (unit-0-only) but per-zone SYSCTL_ADD_NODE dereferences SYSCTL_CHILDREN(NULL) = raw (oid_ptr)->oid_arg1 -> NULL-page read panic at attach/boot. Firmware-gated boot-time DoS.",
 "verdict": "source-verified; firmware/DSDT-gated (guest ACPI namespace has 0 ThermalZone objects - verified live)",
 "exploit_chain": [],
 "evidence": "static 3-hop proof: establish ENXIO at :433-436 -> early return :237-240 before tree creation :253-258 -> zone-1 SYSCTL_CHILDREN(NULL) at :276-278 via sysctl.h:212-213",
 "kernel_refs": [
  "sys/dev/acpica/acpi_thermal.c:237",
  "sys/dev/acpica/acpi_thermal.c:276"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4406/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "create the global sysctl tree before anything that can fail attach (or NULL-guard per-zone node creation)",
 "fix_evidence": "source-only"
}