{
  "finding_id": "DF-4410",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "confidence": "likely",
  "impact": "dos",
  "verdict": "Source-verified use-after-free window: every acpi_asus LED state change is deferred into AcpiOsExecute(OSL_NOTIFY_HANDLER, acpi_asus_led_task, led) (acpi_asus.c:922-935), but acpi_asus_detach never drains that queue - led_destroy (acpi_asus.c:841-857 -> led.c:318-341) frees the ledsc immediately and newbus frees the softc when detach returns, so a task queued just before detach runs acpi_asus_led_task (acpi_asus.c:877-920) over freed memory (led->sc, sc->model->bled_set, acpi_SetInteger(sc->handle,...)). The OSL has no drain primitive (OsdSchedule.c implements only AcpiOsExecute). Secondary: default-arm of the task returns without clearing led->busy (permanent LED wedge), and the busy check/set is racy. Untested at runtime: guest has no ATK0100/ASUS010 nodes and no /dev/led consumers (env.txt); both sides of the race are root-only (0600 led nodes per led.c:305-306; detach/kldunload needs root).",
  "exploit_chain": "root: echo 1 > /dev/led/bled immediately followed by kldunload acpi_asus -> pending task executes over freed softc (UAF). No unprivileged chain.",
  "evidence": "findings/poc/DF-4410/VERDICT.md, README.md, env.txt, fix.diff (drain design)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_asus/acpi_asus.c:922",
    "sys/dev/acpica/acpi_asus/acpi_asus.c:877",
    "sys/dev/acpica/acpi_asus/acpi_asus.c:841",
    "sys/dev/misc/led/led.c:318",
    "sys/dev/misc/led/led.c:305"
  ],
  "poc_changes": "",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "c032390f8ac9f680433707eafa90ab7d3909e1b7839bd7a8075db218ade60947",
  "notes": "memcorrupt-bucket class (UAF) but root+firmware gated; race window is OSL notify-queue latency. led.c itself is in-bounds-safe; the defect is the acpi_asus glues missing detach drain.",
  "recommended_fix": "Add per-softc led_lock/led_dying/led_pending; gate AcpiOsExecute on !dying, count outstanding tasks, and have detach wait for quiescence before led_destroy; clear led->busy on the task default path; see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from source analysis (drain-before-destroy); cannot be built/validated on the audit guest - acpi_asus never attaches here and no /dev/led exists.",
  "fix_evidence": "findings/poc/DF-4410/fix.diff; env.txt"
}