# DF-4408 VERDICT — untested (source-verified; firmware-gated boot-time panic)

## Reproduced?

No. Status `untested`: triggering requires an ACPI device whose HID matches
`ATK0100` or `ASUS010` (`acpi_asus.c:553,561`) **and** a broken `INIT`
method. The audit guest's ACPI namespace contains zero such nodes (verified
live — `env.txt`), so the driver never even probes. Loading a crafted DSDT
requires root (and on this guest, a custom QEMU BIOS blob). This is a
firmware-compatibility crash of the class that historically hit real laptops
(e.g. Samsung P30 PRs upstream), not an unprivileged attack path.

## Defect (certain from source)

`acpi_asus_probe` evaluates `INIT` and uses the result blind:

1. `acpi_asus.c:579` — `AcpiEvaluateObject(sc->handle, "INIT", &Args, &Buf)`
   return status discarded. Buffer was reset at `acpi_asus.c:576-577`
   (`Buf.Pointer = NULL; Buf.Length = ACPI_ALLOCATE_BUFFER`), so on failure
   (no `INIT` method, AML error, serializer trouble) `Buf.Pointer` remains
   NULL.
2. `acpi_asus.c:586` — `if (Obj->String.Pointer == NULL)` dereferences `Obj`
   with no `Obj != NULL` check → panic in probe.
3. No `Obj->Type == ACPI_TYPE_STRING` validation: if `INIT` returns an
   Integer (some BIOS variants do), `Obj->String.Pointer` is read from union
   bytes that belong to a different member (`ACPI_OBJECT_STRING.Pointer`
   sits at offset 16, past `ACPI_OBJECT_INTEGER.Value` at offset 8) →
   garbage pointer → `strncmp` wild read at `acpi_asus.c:621`.
4. Even the *intended* NULL-string branch falls through: when
   `Obj->String.Pointer == NULL` but the DSDT is neither Samsung `ODEM`
   (`acpi_asus.c:597`) nor `ASUS010` EeePC (`acpi_asus.c:605`), control
   leaves the `if` block and reaches `strncmp(Obj->String.Pointer, ...)` at
   `acpi_asus.c:621` with a NULL first argument → guaranteed panic. This
   makes the defect reachable on any ATK0100 machine whose INIT misbehaves,
   not just exotic ones.

Impact: NULL/wild-pointer dereference in `device_probe` context → kernel
panic at attach (boot-time or rescan DoS). No write primitive, no disclosure.

## Fix

`fix.diff`: validate status + `Obj != NULL` + `Type == ACPI_TYPE_STRING`,
keep the Samsung/EeePC NULL-string detection branch, and make its tail return
`ENXIO` instead of falling into the model loop. Not validated on hardware
(no applicable firmware on guest) → fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.