{
  "finding_id": "DF-4890",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect is statically certain: AcpiOsAcquireLock (sys/dev/acpica/Osd/OsdSynch.c:383-388) takes spin_lock(&Spin->slock) when called from the idle thread but lockmgr(&Spin->lock)+crit_enter() for all other threads, and release (OsdSynch.c:423-428) mirrors the split \u2014 the two classes never exclude each other across CPUs. The idle-thread side is live via cpu_idle_hook=acpi_cst_idle (acpi_cpu_cstate.c:786) whose C3 BM/ARB paths call AcpiWriteBitRegister (acpi_cpu_cstate.c:935,958,977), which holds AcpiGbl_HardwareLock around a PM1/PM2 register RMW (hwxface.c:411-471); normal-thread takers of the same lock (acpi_cpu_cstate.c:668,810; AcpiHwClearAcuiStatus hwregs.c:574 on resume/sleep) run concurrently on other CPUs, interleaving masked RMWs of the same registers (lost BM_STS clears, lost ARB_DISABLE, mangled PM1_STS clears). Not reproduced at runtime: the QEMU guest has 6 CPUs and cpu_cst attached but advertises only C1/0 (env.txt/run.log), so the idle-side taker never executes there; reproduction requires real hardware with CST C2/C3 plus an instrumented kernel (methodology in VERDICT.md). Impact ceiling is availability/platform-state malfunction, not kernel memory corruption; severity Low.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full static proof with path:line and guest-run explanation); env.txt + run.log (guest probe: hw.ncpu=6, cpu_cst0-5 attached, cx_supported C1/0 only -> C2/C3 precondition ABSENT on this guest); precond_probe.sh (runnable probe); race_trigger.sh (real-hardware amplifier); fix.diff (single-primitive fix)",
  "kernel_refs": [
    "sys/dev/acpica/Osd/OsdSynch.c:374-403",
    "sys/dev/acpica/Osd/OsdSynch.c:405-429",
    "sys/dev/acpica/acpi_cpu_cstate.c:786",
    "sys/dev/acpica/acpi_cpu_cstate.c:933-935",
    "sys/dev/acpica/acpi_cpu_cstate.c:957-977",
    "sys/contrib/dev/acpica/source/components/hardware/hwxface.c:411-471",
    "sys/contrib/dev/acpica/source/components/hardware/hwregs.c:574-581",
    "sys/contrib/dev/acpica/source/components/utilities/utmutex.c:206-218"
  ],
  "poc_changes": "n/a (finding authored in verify-of-self audit; probe written fresh \u2014 no seed PoC existed)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "n/a (shell probe, no compile)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root ...cx_/cst probe... > run.log (see run.log); on real hw: sh race_trigger.sh",
  "code_hash": "3d81e6c20cee43f59095f58e451d0c1af1626c79cedcda1570f29da12f3bef8b",
  "notes": "Pass-2 OsdSynch.c answers for the record: (1) ACPICA mutexes map to 1-unit semaphores (actypes.h:382-385), recursion is handled ACPICA-side (exmutex.c:302-308 AcquisitionDepth) so the non-recursive mapping is compliant; global-mutex ordering check exists only under ACPI_MUTEX_DEBUG (utmutex.c:381-415). (2) ACPI_WAIT_FOREVER is capped ~66 s (OsdSynch.c:158-161) and PCATCH signals escape the ssleep loop via the absolute-deadline check (OsdSynch.c:236-245). (3) SCI is threaded (OsdInterrupt.c:103 INTR_MPSAFE), so no lockmgr-from-hard-IRQ. (4) No in-tree site nests the same OSL spinlock -> no lockmgr recursion panic. Fix validation not possible on this guest (baseline race not hostable); fix.diff reasoning line-accurate per VERDICT.md.",
  "recommended_fix": "Take spin_lock(&Spin->slock) in BOTH branches of AcpiOsAcquireLock/AcpiOsReleaseLock around the critical section, keeping lockmgr only as the sleepable contention lock for normal threads",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; not built/validated because the baseline race cannot be hosted on the QEMU guest (no ACPI C2/C3 states advertised \u2014 see env.txt). The patch is mechanically minimal and its safety argument (OSL-spinlock sections are short non-blocking register RMWs, so the idle thread never spins against a sleeping holder) is documented in VERDICT.md and the diff comment.",
  "fix_evidence": "findings/poc/DF-4890/fix.diff; VERDICT.md Fix validation section; env.txt (guest C1-only)"
}