DF-5073 / run.2.log
DF-5073 โ leak boot, unprivileged reader, process-level grooms
===============================================================
Boot command:
cd dfbsd-qemu && QEMU_EXTRA="-acpitable file=ssdt_acad_leak.aml" ./vm.sh up 300
SSDT: ACPI0003 device PWRS whose _PSR evaluates OK but returns NO object
(iasl warnings 3115/3107: "Not all control paths return a value",
"Reserved method must return a value (Integer required for _PSR)").
Expected CORRECT behavior: acpi_GetInteger returns AE_TYPE-ish behavior,
newstatus stays -1, hw.acpi.acline reads -1 (or the init never succeeds).
OBSERVED: hw.acpi.acline reads 0 โ only reachable through the uninitialized
ACPI_OBJECT param path (param.Type residue == ACPI_TYPE_INTEGER(4),
param.Integer.Value residue low dword == 0).
Transcript (each command a separate process; grooms therefore land in other
kstacks โ same-thread grooming is in run.log):
$ sysctl hw.acpi.acline (as uid 1001 via ssh dfbsd-maxx)
hw.acpi.acline: 0
$ sysctl hw.acpi.acline
hw.acpi.acline: 0
(after `sysctl -a`, after `ls -lR /usr/include`, after `find / -maxdepth 3`:
all reads still 0 โ see below)
== baseline, no groom: 0
== groom: sysctl -a: 0
== groom: ls -lR /usr/include: 0
== groom: find -name "*.conf": 0
== groom: sysctl -a again: 0
Root-side dmesg on this boot:
ACPI: SSDT 0x00000000BFFE1CAC 000050 (v02 DFACAD ACADSANE...) <- (boot A)
ACPI: SSDT 0x00000000BFFE1CAC 000053 (v02 DFACAD ACADLEAK 00000001 INTL 20251212)
acpi_acad0: <AC Adapter> on acpi0