# Shared environment for DF-5430..DF-5433 (acpi_madt.c pass-2 verification)

Host rig:
  QEMU emulator version 7.2.22 (Debian 1:7.2.0+dfsg-7+deb12u18), KVM
  dfbsd-qemu/vm.sh lifecycle; -enable-kvm -m 4096 -smp 6, serial -> boot.log
  QEMU monitor at dfbsd-qemu/boot-mon.sock (physical memory dumps via `xp`)

Guest kernel builds used (both stock X86_64_GENERIC, INVARIANTS enabled —
sys/config/X86_64_GENERIC:56):
  A: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC   ("with-src" snapshot)
  B: DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29 14:18:01 UTC 2026
     root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC
                                                ("clean-install" snapshot)

Injection vector (all findings):
  /boot/loader.conf:  hint.acpi.0.rsdp=0x40000000
    -> sdt_probe() kenv path, sys/platform/pc64/acpica/acpi_sdt.c:71
       (NO signature / checksum validation on the hinted RSDP)
  QEMU:  -device loader,file=<blob>,addr=0x40000000,force-raw=on
  blob:  RSDP(rev0)->RSDT(1 entry)->MADT, see gen_madt.py
  NOTE:  QEMU -acpitable does NOT work: it appends after built-in tables and
         sdt_search_xsdt() takes the FIRST signature match (acpi_sdt.c:211-221),
         so the built-in MADT shadows the injected one. The kenv-hint +
         loader-device rig replaces the whole ACPI root instead.

Baseline (unmodified) guest: 6 vCPUs, madt_lapic_probe: lapic_count=6,
"ACPI CPUS = 6", real MADT from BOCHS RSDP @0xF59A0.

Rig artifacts (present in ALL injected boots incl. healthy control, AFTER
the stages under test): `fadt_probe: can't locate FADT` and a late DDB stop
in AcpiTbLoadNamespace (minimal injected RSDT lacks FADT/DSDT). All four
findings manifest strictly earlier (SI_BOOT2_PRESMP / IOAPIC / START_APS).

Scenario kernels:
  control      -> DF pack ../DF-5430 (rig validation): full MADT->SMP path OK
  bsp_omit     -> run.log (kernel A), run.2.log (kernel B)
  ioapic_overlap -> run.log (kernel B)
  fake_ioapic  -> run.log (kernel B), run.3.log (kernel A = fix baseline)
  dup_cpu      -> run.log (kernel B)