DF-4484 / fix_run.log
=== env === DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sun Sep 20 19:20:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 === 1. load acpi_video (attach: LCD0._BCL call #1 -> valid package) === --- levels after attach (expect: 100 55 90 75 55 25) --- hw.acpi.video.lcd0.levels: 100 55 90 75 55 25 hw.acpi.video.lcd0.fullpower: 100 === 2. active read #1 (_DCS #1, no notify) === hw.acpi.video.lcd0.active: 1 === 3. active read #2 (_DCS #2 -> Notify(VGT0,0x81) REPROBE -> rebind -> _BCL #2 FAILS) === hw.acpi.video.lcd0.active: 1 --- levels after reprobe (expect: EMPTY = numlevels 0, pointer dangling) --- acpi_video0: <ACPI video extension> on vgapci0 evaluation of \_SB_.PCI0.VGT0.LCD0._BCL makes no sense === 4. UAF read: write fullpower=-1 -> presets handler reads freed vo_levels[0] === sysctl: hw.acpi.video.lcd0.fullpower=-1: Operation not supported by device sysctl: hw.acpi.video.lcd0.fullpower=-1: Operation not supported by device sysctl: hw.acpi.video.lcd0.fullpower=-1: Operation not supported by device === done === === NOW kldunload on PATCHED kernel (baseline panicked here) === UNLOAD-RC=0 acpi_video0: <ACPI video extension> on vgapci0 evaluation of \_SB_.PCI0.VGT0.LCD0._BCL makes no sense acpi_video0: detached sysctl: unknown oid 'hw.acpi.video' 7:31PM up 29 secs, 0 users, load averages: 0.16, 0.04, 0.02