{
  "finding_id": "DF-4486",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-certain use-after-free of the notify-handler context: REPROBE (acpi_video.c:385-395) NULLs vo->handle before rebind, so acpi_video_vo_destroy removes the per-output handler via AcpiRemoveNotifyHandler(NULL,...) which returns AE_BAD_PARAMETER without doing anything (evxface.c:399-402); kfree(vo) then runs with the handler still registered on the real device node. Later notifies dispatch acpi_video_vo_notify_handler on freed vo: UAF read at :679 (vo->handle compare) and a 4-byte write-after-free at :737 (vo->vo_brightness, value 0..100) under brightness notifies. vo_bind also never removes the old handler before re-install (:611-613, AE_ALREADY_EXISTS per evxface.c:309-311). Not runtime-demonstrated: visibility requires reallocating the freed M_ACPIVIDEO chunk with controlled content (only vo_init allocates that type). Fixed by the same fix.diff as DF-4484 (vo_matched flag keeps handle valid at destroy).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (static analysis with path:line); evxface.c:399-402 NULL-handle rejection",
  "kernel_refs": [
    "sys/dev/acpica/acpi_video/acpi_video.c:386",
    "sys/dev/acpica/acpi_video/acpi_video.c:390",
    "sys/dev/acpica/acpi_video/acpi_video.c:628",
    "sys/contrib/dev/acpica/source/components/events/evxface.c:399"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Runtime visibility needs controlled M_ACPIVIDEO reallocation (driver-internal type); destroy-with-NULL-handle path itself proven reachable via DF-4484s choreography.",
  "recommended_fix": "Track reprobe matching with a vo_matched flag instead of NULLing vo->handle; remove the old notify handler in vo_bind before re-install",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Covered by DF-4484s fix.diff (same patch); not independently runtime-tested.",
  "fix_evidence": "DF-4484/fix.diff"
}