# DF-4409 VERDICT — untested (source-verified use-after-free; root-gated, firmware-gated)

## Reproduced?

No. Status `untested`: requires (a) an ASUS/Samsung/EeePC laptop whose ACPI
exposes ATK0100/ASUS010 (the audit guest has none — verified live, `env.txt`)
and (b) a root-initiated detach / `kldunload acpi_asus` racing a firmware
notify. No unprivileged trigger.

## Defect (certain from source)

- attach installs `sc->model->n_func` as the `ACPI_SYSTEM_NOTIFY` handler
  with `dev` as context (`acpi_asus.c:810-811`). For the EeePC model that is
  `acpi_asus_eeepc_notify` (`acpi_asus.c:455`, table entry "EEE").
- detach removes `acpi_asus_notify` — a different function pointer
  (`acpi_asus.c:860-861`). ACPICA removes handlers by the
  (device, handler-type, handler) triple, so the call returns
  `AE_BAD_PARAMETER` and the *installed* handler remains registered; the
  ignored return value hides this.
- After `acpi_asus_detach` returns, newbus frees the softc. The surviving
  handler's next invocation (any hotkey/notify event) executes
  `acpi_asus_eeepc_notify` (`acpi_asus.c:1261-1281`):
  `sc = device_get_softc((device_t)context)` on freed memory, then
  `acpi_device_get_parent_softc(sc->dev)` and
  `acpi_asus_sysctl_set(sc, ...)` writing `sc->s_brn` — use-after-free
  read/write. With the module also unloaded, the handler text itself is
  gone — control transfer into unmapped memory.
- Window: not merely theoretical — ACPI notifies are asynchronous EC events
  (lid/hotkey), and detach of a laptop-extra driver under an active ACPI
  namespace receives events routinely.

## Impact ceiling

Root-gated panic / kernel memory corruption in freed softc (attacker needs
root to detach; the freed-slot reuse is not attacker-shaped). DoS-class in
practice; the UAF class justifies a memcorrupt-bucket filing for upstream
correctness, but it is not an escalation primitive.

## Fix

`fix.diff`: store the handler that was installed (`sc->n_func`) and remove
exactly that in detach. Also stops attach from writing into the shared
static model table (see DF-4411). Not validated on hardware
(fix_status: not_testable).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.