# DF-5145 — ipmi_acpi SSIF dead-softc attach → NULL `ipmi_enqueue_request` call on detach

## What this proves

Firmware that describes its BMC with an ACPI `IPI0001` device whose `_IFT` is
4 (`SSIF_MODE`, ipmivars.h:132) makes `ipmi_acpi_attach()` **return success
while leaving the softc completely uninitialized** — it never runs
`ipmi_kcs_attach`/`ipmi_smic_attach` (so `sc->ipmi_enqueue_request` is NULL),
never calls `ipmi_attach()` (so `lockinit` in `ipmi_startup()` never happens,
no cdev, `ipmi_attached` stays 0).

Every later detach of that device — the `SYSUNINIT(ipmi_unload)` at every
shutdown/reboot (ipmi.c:940), or module teardown — runs DFly's
`ipmi_detach()` → `ipmi_set_watchdog(sc, 0)` (ipmi.c:887) →
`ipmi_submit_driver_request()` → `sc->ipmi_enqueue_request(sc, req)` — an
**indirect call through a NULL function pointer → fatal kernel trap**.

## Files

- `ssdt_gen.py` — writes `ssdt-ipmi-ssif.aml` (hand-assembled AML, no iasl)
- `build.sh` — build the audit-tree `ipmi.ko` + kernel inside the guest
- `run.sh` — the full reproduction sequence (baseline)
- `fix.diff` — the verified fix (ipmi_acpi.c: refuse SSIF instead of
  no-op-attaching) + defensive guard in ipmi.c
- `panic.txt` — serial-console capture of the fatal trap (baseline run)
- `verdict.json` — machine verdict

## Reproduce

1. `python3 ssdt_gen.py ssdt-ipmi-ssif.aml`
2. Boot the guest with the table attached:
   `cd dfbsd-qemu && QEMU_EXTRA="-acpitable file=$PWD/ssdt-ipmi-ssif.aml" ./vm.sh up`
   (kernel must be built from the audit tree — the stock prebuilt guest
   kernel is newer and ignores RSDT-SSDT-added devices; see VERDICT.md)
3. `vm.sh run_root 'kldload /root/ipmi-audit.ko'`
   → dmesg: `ipmi0: SSIF interface not supported on ACPI`  (attach "succeeded",
   device attached, softc dead)
4. `vm.sh run_root 'reboot'`
   → serial console: `Fatal trap 12: page fault while in kernel mode` at
   `fault virtual address = 0x0` inside `ipmi_submit_driver_request`

## Expected result

Baseline: kernel panic on every reboot of a machine whose ACPI describes an
SSIF BMC (deterministic NULL function-pointer call; no attacker control of
the target — CWE-476).

Patched (fix.diff): `ipmi_acpi_attach` returns ENXIO for `_IFT==4`, the ACPI
node is left unattached, reboot is clean.