{
  "finding_id": "DF-4485",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Reproduced: vo_get_brightness_levels frees the _BCL ACPI eval buffer only on failure paths; the success return at acpi_video.c:1002-1003 leaks bcl_buf.Pointer on every attach/rebind. 39 firmware REPROBEs (SSDT-B, one per sysctl read) grew the M_ACPICA arena from 51 allocs/10.2K to 209 allocs/267K (+257KB, ~3.3KB per leaked 64-entry _BCL buffer) while a 10s idle control showed zero growth. Leak rate and per-event size are firmware/table-controlled -> kernel memory exhaustion class. Low severity (needs firmware notify control; crafted-table/boot privilege or buggy firmware).",
  "exploit_chain": "crafted SSDT _BCL with 64-entry package + per-read 0x81 reprobe notifies -> each rebind leaks the eval buffer -> measured unbounded M_ACPICA growth.",
  "evidence": "run.log (vmstat -m acpica baseline 51/10.2K, control 51/10.2K, after 209/267K; levels still valid)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_video/acpi_video.c:1002",
    "sys/dev/acpica/acpi_video/acpi_video.c:1005",
    "sys/dev/acpica/acpi_video/acpi_video.c:960"
  ],
  "poc_changes": "SSDT-B written from scratch; 64-entry _BCL to make the leak measurable in vmstat -m.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "iasl ssdt_dfb.asl; QEMU_EXTRA=\"-acpitable file=ssdt_dfb.aml\" vm.sh up",
  "run_cmd": "vm.sh run_root sh /tmp/run_df4485.sh",
  "code_hash": "44b98380ccdb240a",
  "notes": "Fix validated on patched kernel: arena flat across the same 40-read loop (fix_run.log).",
  "recommended_fix": "AcpiOsFree(bcl_buf.Pointer) on the success path of vo_get_brightness_levels before returning n",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel: same 40-read REPROBE loop leaves the acpica malloc arena flat (no growth), levels stay correct.",
  "fix_evidence": "fix.diff; fix_run.log (patched vmstat before/after identical)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}