=== env ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
=== 1. load acpi_video (attach: LCD0._BCL call #1 -> valid package) ===
--- levels after attach (expect: 100 55 90 75 55 25) ---
hw.acpi.video.lcd0.levels: 100 55 90 75 55 25
hw.acpi.video.lcd0.fullpower: 100
=== 2. active read #1 (_DCS #1, no notify) ===
hw.acpi.video.lcd0.active: 1
=== 3. active read #2 (_DCS #2 -> Notify(VGT0,0x81) REPROBE -> rebind -> _BCL #2 FAILS) ===
hw.acpi.video.lcd0.active: 1
--- levels after reprobe (expect: EMPTY = numlevels 0, pointer dangling) ---
acpi_video0: <ACPI video extension> on vgapci0
evaluation of \_SB_.PCI0.VGT0.LCD0._BCL makes no sense
=== 4. UAF read: write fullpower=-1 -> presets handler reads freed vo_levels[0] ===
hw.acpi.video.lcd0.fullpower: 100 -> -1920985560
hw.acpi.video.lcd0.fullpower: -1920985560
hw.acpi.video.lcd0.fullpower: -1920985560 -> -1920985560
hw.acpi.video.lcd0.fullpower: -1920985560
hw.acpi.video.lcd0.fullpower: -1920985560 -> -1920985560
hw.acpi.video.lcd0.fullpower: -1920985560
=== done ===
hw.acpi.video.lcd0.fullpower: -1920985560
=== kldunload -> vo_destroy frees DANGLING vo_levels again (double free) ===

=== 5. double-free (separate boot, same choreography, UNPATCHED kernel #0) ===
root@dfbsd# kldunload acpi_video
(ssh session dies; vm.sh status -> down; serial console:)
panic: memory chunk 0xfffff8008d801580 is already free!
cpuid = 4
Trace beginning at frame 0xfffff801180a9768
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
_kfree() at _kfree+0x262 0xffffffff806580e2
acpi_video_vo_destroy() at acpi_video_vo_destroy+0x6a 0xffffffff826001ca
acpi_video_detach() at acpi_video_detach+0x79 0xffffffff82600b39
device_detach() at device_detach+0x74 0xffffffff8068e5a4
Debugger("panic")
(full text: panic.txt; on the PATCHED kernel #1 the identical unload returns
rc=0 with "acpi_video0: detached" and no panic -- fix_run.log)