{
  "finding_id": "DF-4953",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Firmware-gated (crafted ATK0110 DSDT; no ASUS node on guest): aibs_attach_sif kmallocs and publishes the per-family sensor arrays before element validation; malformed-but-well-typed elements continue so no sensors attach, and when all families yield zero the ENXIO exit never frees the arrays - and DFly newbus never calls detach after a failed attach (DS_NOTPRESENT), so the allocations leak permanently (a re-attach would orphan them again). One-shot ~112B/entry leak per family; pre-boot control precondition. Free-on-ENXIO fix.",
  "exploit_chain": "crafted ?SIF packages (valid integer header, all elements malformed) -> arrays allocated+published -> zero sensors attached -> ENXIO without free -> permanent leak",
  "evidence": "findings/poc/DF-4953/ (this verdict)",
  "kernel_refs": [
    "sys/dev/acpica/aibs/atk0110.c:126-129",
    "sys/dev/acpica/aibs/atk0110.c:198",
    "sys/dev/acpica/aibs/atk0110.c:205-218",
    "sys/kern/subr_bus.c:2115-2121"
  ],
  "guest_uname": "",
  "code_hash": ""
}