{
  "finding_id": "DF-4824",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Logic/robustness gap (no demonstrated memory corruption): acpi_dock_eject_child ignores device_detachs return and unconditionally executes _EJ0 - when a child returns EBUSY (mounted disk, open tty on the docked bus) the firmware ejects hardware out from under still-attached drivers (surprise-removal class, driver-dependent fault ceiling). Root-driven undock only; guest SSDT harness cannot force a child EBUSY deterministically. Abort-eject-on-failure fix (surface error so the state machine does not mark UNDOCKED with dependents attached).",
  "exploit_chain": "hold open a dock-provided device; sysctl hw.acpi.dock.status=0 -> _EJ0 executes despite EBUSY -> driver runs on vanished hardware",
  "evidence": "findings/poc/DF-4824/ (this verdict)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_dock/acpi_dock.c:300",
    "sys/dev/acpica/acpi_dock/acpi_dock.c:306"
  ],
  "guest_uname": "",
  "code_hash": ""
}