# DF-5430 — MADT BSP-entry omission passes probe, trips `KKASSERT(arg.bsp_found)` boot panic

## What

`sys/platform/pc64/acpica/acpi_madt.c` — `madt_lapic_probe()` never verifies
that the hardware BSP's APIC ID (from `LAPIC_READID`) appears among the
enabled CPU entries; `madt_lapic_pass2()` then `KKASSERT(arg.bsp_found)`
(acpi_madt.c:375). A crafted MADT whose enabled entries all have
`Id != bsp_apic_id` sails through probe and panics the kernel at boot
(INVARIANTS kernels). On production (non-INVARIANTS) kernels the assert is
compiled out (sys/sys/systm.h:118) and the BSP silently keeps the BSS-zero
`cpu_id_to_apic_id[0]` mapping (DF-5366's missing sentinel), mis-addressing
cpu 0 whenever the hardware BSP ID is non-zero.

## Rig (real kernel-boot manifestation, not a userland model)

The standard QEMU guest accepts a kenv hint that redirects the entire ACPI
root: loader.conf `hint.acpi.0.rsdp=0x40000000` is consumed by
`sdt_probe()` (acpi_sdt.c:71) **with no signature or checksum validation**,
and QEMU's `-device loader,file=...,addr=0x40000000,force-raw=on` plants an
attacker-crafted RSDP→RSDT→MADT chain in guest RAM before boot.
(`-acpitable` does NOT work for this: it appends after the built-in tables
and `sdt_search_xsdt()` takes the first signature match, acpi_sdt.c:211-221.)

## Build

    python3 gen_madt.py bsp_omit /tmp/madt_bsp_omit.bin

## Run

    # guest booted normally once, then:
    vm.sh run_root 'printf "hint.acpi.0.rsdp=0x40000000\n" >> /boot/loader.conf; sync'
    vm.sh down
    QEMU_EXTRA="-device loader,file=/tmp/madt_bsp_omit.bin,addr=0x40000000,force-raw=on" vm.sh up
    vm.sh log   # watch serial console

## Expected output (see run.log / run.2.log)

    madt_lapic_probe: lapic_count=2 x2apic_count=0     <- probe ACCEPTS the table
    panic: assertion "arg.bsp_found" failed in madt_lapic_pass2 at \
        /usr/src/sys/platform/pc64/acpica/acpi_madt.c:375

Reproduced on both guest kernel builds (Jul 2 "with-src" build and the
Jun 29 clean-install build). Controls: `control` scenario (BSP entry present)
boots through the full MADT→SMP path; see ../DF-5432 pack for a control run.

## Trigger table (bsp_omit)

MADT with `Address=0xFEE00000`, `Flags=1`, and exactly two enabled
LOCAL_APIC entries: `{ProcessorId=1, Id=1, EN}`, `{ProcessorId=2, Id=2, EN}`
— no entry with `Id == 0` (the KVM BSP's hardware APIC ID).