{
 "finding_id": "DF-4511",
 "poc_id": "DF-4511",
 "status": "untested",
 "reproduced": 0,
 "impact": "Boot-time NULL-deref panic on missing Return; type-confused wild memcpy read with contents rendered via world-readable /dev/wmistat",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "ACPICA permits AE_OK with NULL Pointer (nsxfeval.c:541-546) and any object type; read_wdg_blocks uses obj->Buffer immediately. Firmware-gated (ACPI table control). FreeBSD inherited the same defect (they validate in their _BMOF path - the fix pattern exists upstream).",
 "kernel_refs": [
  "sys/dev/acpica/acpi_wmi/acpi_wmi.c:725",
  "sys/dev/acpica/acpi_wmi/acpi_wmi.c:727",
  "sys/dev/acpica/acpi_wmi/acpi_wmi.c:728",
  "sys/dev/acpica/acpi_wmi/acpi_wmi.c:734"
 ],
 "verdict": "not_run: Low, firmware-gated, Phase V skipped per contract",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable",
 "fix_evidence": "validate obj/Type/Length%sizeof before use (finding markdown diff)"
}