{
 "finding_id": "DF-4409",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "dos",
 "verdict": "Source-verified use-after-free: acpi_asus_attach installs sc->model->n_func (= acpi_asus_eeepc_notify on EeePC, acpi_asus.c:455,810-811) with dev as context, but acpi_asus_detach removes hardcoded acpi_asus_notify (acpi_asus.c:860-861). ACPICA removal matches the (device,type,handler) triple, so it fails with an ignored AE_BAD_PARAMETER and the real handler survives detach. The next ACPI notify then runs acpi_asus_eeepc_notify over the freed softc (device_get_softc(context), acpi_asus.c:1268) - UAF read/write - or jumps into unloaded module text after kldunload. Untested at runtime: audit guest has zero ATK0100/ASUS010 ACPI nodes (env.txt) and the detach must be root-initiated, so no unprivileged trigger exists; practical ceiling is root-gated panic/corruption of freed softc memory.",
 "exploit_chain": "root: kldunload acpi_asus (or devctl detach) while firmware notify pending -> handler survives removal -> notify fires into freed softc (UAF) / unmapped text. No unprivileged chain.",
 "evidence": "findings/poc/DF-4409/VERDICT.md (path:line trace), README.md, env.txt, fix.diff",
 "kernel_refs": [
  "sys/dev/acpica/acpi_asus/acpi_asus.c:455",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:807",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:810",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:860",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:1268"
 ],
 "poc_changes": "",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 5,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "62c7771ab6c7e558786cf109d45f9d43bb5861503b5dc445fbe2947e23f23ea4",
 "notes": "memcorrupt-bucket class (UAF) but hardware+root gated; runtime PoC impossible on this guest (driver never attaches). Static-table mutation overlap tracked separately as DF-4411.",
 "recommended_fix": "Record the installed handler in the softc (sc->n_func) and pass it to AcpiRemoveNotifyHandler verbatim in detach; see fix.diff.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored from source analysis; cannot be validated on the audit guest - acpi_asus only attaches on ATK0100/ASUS010 firmware, absent from the guest namespace.",
 "fix_evidence": "findings/poc/DF-4409/fix.diff; env.txt"
}