# DF-5483 control run — guest output (stock kernel, planted tables, TCG SandyBridge)

## dmesg (decisive lines)
```
Preloaded elf obj module "/boot/kernel/estforce.ko" at 0xffffffff81de6470.
estforce: cpu_feature2 |= CPUID2_EST (now 0x96982283)
ACPI: RSDP 0x0000000040000000 000014 (v00 DFBSD )
ACPI: RSDT 0x0000000040000100 00002C (v01 DFBSD           43414900 T?   00000000)
ACPI: FACP 0x0000000040000200 000080 (v01 DFBSD           43414900 T?   00000000)
ACPI: DSDT 0x0000000040001000 00026B (v02 TST    DSDT     00000001 INTL 20251212)
ACPI: FACS 0x0000000040000280 00000040
ACPI: APIC 0x0000000040000400 000068 (v03 DFBSD           43414900 T?   00000000)
ACPI: 1 ACPI AML tables successfully acquired and loaded
cpu_pst0.cpu0.acpi0.nexus0.root0
cpu_pst0: <ACPI CPU P-State> [tentative] on cpu0
cpu_pst0: control reg 1 80            <- firmware-chosen IO port, allocated
cpu_pst0: status reg 1 81
cpu_pst0: freq 3000, pwr 1, xlat 10, blat 10, cv 000000aa, sv 00000000
cpu_pst0: <ACPI CPU P-State> [attached!] on cpu0
...
cpu_pst1: Destroy domain1, force pkg domain0
...
```

## sysctl surface after boot (root)
```
hw.acpi.cpu.px_dom0.available: 3000
hw.acpi.cpu.px_dom0.select: 3000
hw.acpi.cpu.px_dom0.members: cpu0(3000)     <- kernel READ port 0x81; matched st_sval
hw.acpi.cpu.px_global: 3000                  <- boot transition already executed
```

## unprivileged user (uid 1001 maxx) — world-readable read oracle
```
$ id
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
$ sysctl hw.acpi.cpu.px_dom0.members
hw.acpi.cpu.px_dom0.members: cpu0(3000)
$ sysctl hw.acpi.cpu.px_dom0.available
hw.acpi.cpu.px_dom0.available: 3000
```

## root re-trigger (write path on demand)
```
# sysctl -w hw.acpi.cpu.px_global=3000
hw.acpi.cpu.px_global: 3000 -> 3000
# sysctl -w hw.acpi.cpu.px_dom0.select=3000
hw.acpi.cpu.px_dom0.select: 3000 -> 3000
```
(every accepted write re-executes acpi_pst_md_res_write(ctrl, cval))

## destructive run tail (separate boot; ctrl=0x604/16-bit, cval=0x2000)
see run.poweroff_console.log — console output ends at:
```
cpu5: ioport allocation failed for control register
ACPI: domain1 P-State configuration check failed
```
the surviving domain0/cpu0 executes outw(0x604, 0x2000) immediately after:
ACPI S5, machine off, ssh never answers, vm.sh status -> down.