# DF-5433 — No APIC-ID dedup in MADT CPU enumeration → duplicate entries create phantom AP slots, SMP boot wedges

## What

`madt_lapic_pass2_callback` / `madt_x2apic_pass2_callback`
(acpi_madt.c:280-346) assign a fresh `cpu` slot to EVERY enabled entry
without checking whether that APIC ID was already assigned (and without
checking the ID names a real CPU — there is no cross-check against
anything). Duplicates inflate `naps` (acpi_madt.c:376) and leave two cpu
slots pointing at one local APIC; nonexistent IDs leave a slot pointing at
nothing. `start_all_aps()` (mp_machdep.c:482-541) then SIPIs the phantom
slot: a duplicate ID re-INITs an already-running AP and a nonexistent ID
times out — either way SMP startup never completes. This is the MADT
sibling of mptable's DF-5343, and is DISTINCT from DF-1064: it triggers
with as few as 3 entries, entirely in-bounds, no OOB write involved
(DF-1064's note that "probe never deduplicates" is about enabling the
counter OOB; the phantom-CPU mis-boot itself was never filed).

## Rig

Identical to ../DF-5430 (`hint.acpi.0.rsdp` + QEMU `-device loader`).

## Build

    python3 gen_madt.py dup_cpu /tmp/madt_dup_cpu.bin

## Run

    vm.sh run_root 'printf "hint.acpi.0.rsdp=0x40000000\n" >> /boot/loader.conf; sync'
    vm.sh down
    QEMU_EXTRA="-device loader,file=/tmp/madt_dup_cpu.bin,addr=0x40000000,force-raw=on" vm.sh up 110
    vm.sh log

## Expected output (run.log)

    madt_lapic_probe: lapic_count=3 x2apic_count=0
    ACPI CPUS = 3
    Warning: No next valid APICID found. Returning -1
    SMI Frequency (worst case): 35714 Hz (28 us)
    [boot stops — no "Initialize MI interrupts", no SMP CPU1 banner,
     ssh never comes up; guest wedged in start_all_aps]

Trigger table: `LAPIC{0,0,EN}, LAPIC{1,1,EN}, LAPIC{2,1,EN}` — APIC ID 1
appears in two enabled entries, so cpu1 and cpu2 both target LAPIC 1 while
only one physical AP exists for it.