# DF-5583 VERDICT — REPRODUCED (boot-time kernel NULL-deref panic; fix validated)

**Finding:** `acpi_sci_test()` (sys/platform/pc64/acpica/acpi_fadt.c:183-217)
passes `register_int()`'s return value — which is **NULL** when the exclusive
registration collides with an existing handler (sys/kern/kern_intr.c:276-285,
`goto done` with `rec == NULL`) — straight into `unregister_int()`
(acpi_fadt.c:205), which dereferences it unconditionally
(sys/kern/kern_intr.c:425, `intr = ((intrec_t)id)->intr;`).

**Attacker input:** the FADT `SciInterrupt` field (offset 46) — firmware
table content, delivered via the proven planted-ACPI rig (loader kenv
`hint.acpi.0.rsdp`, accepted with no validation, acpi_sdt.c:71). The value is
bounds-checked only against the legacy-irq map (`machintr_legacy_intr_find`,
acpi_fadt.c:226; both ICU and IOAPIC implementations range-check the number
but know nothing about *registered handlers*), so any irq that is already
exclusively owned when acpi0 attaches reaches `register_int(INTR_EXCL|...)`
and fails.

**Collision provider used in the PoC:** the 8254 clock handler `"clk"` on
IRQ0, registered `INTR_EXCL|INTR_CLOCK` by `i8254_intr_initclock()`
(sys/platform/pc64/isa/clock.c:1289-1298) at `SI_BOOT2_CLOCKREG`
(kern_cputimer.c:466 `cputimer_intr_initclocks`) — i.e. *before* acpi0
attaches at `SI_SUB_CONFIGURE`, where `AcpiOsInstallInterruptHandler`
(sys/dev/acpica/Osd/OsdInterrupt.c:69) calls `acpi_sci_config()`. Any boot
where the i8254 is the interrupt cputimer (no LAPIC timer: PIC/ICU systems,
`hw.lapic_timer_enable=0`, many embedded/older platforms) has this precondition
naturally; the rig reproduces it deterministically on the QEMU guest.

## How it was reproduced (this pack)

1. **Control** (`fadt_control_sci9.bin`, SCI_INT=9, everything else identical):
   planted chain accepted (`ACPI SDT: RSDP in kenv hint`; ACPICA core also
   follows it — `ACPI: RSDP 0x0000000040000000`), `IOAPIC: testing 8254
   interrupt delivery... success`, `vmstat -i` shows `clk` live on IRQ0,
   `ACPI FADT: SCI testing ... SCI select level/high` — the dummy handler
   registers and unregisters cleanly on the *free* irq 9. Guest reaches full
   userspace + ssh. (run.control_boot.log, run.control_vmstat.txt)

2. **Attack** (`fadt_attack_sci0.bin`, only field 46 changed 9→0):
   ```
   ACPI FADT: SCI testing interrupt mode ...
   ACPI FADT: SCI testing edge/high
   Fatal user address access from kernel mode from swapper at ffffffff80620f35
   Fatal trap 12: page fault while in kernel mode
   fault virtual address = 0x28
   fault code = supervisor read data, page not present
   Stopped at unregister_int+0x25: movl 0x28(%rdi),%r12d
   ```
   `0x28` is exactly `offsetof(struct intrec, intr)` (kern_intr.c:50-59:
   next, info, handler, argument, name = 5×8 bytes) and `rdi` is the NULL
   `sci_desc`. Guest sits in DDB (`db>`), ssh never answers —
   `reproduced`/`panic`. (run.attack_panic.log, panic.txt)

## Impact assessment

Boot-time kernel NULL-page read at a fixed offset; the loaded value is only
used as a comparison key in the reclist walk and range-checked afterwards, so
with page 0 unmapped (always on this platform, and DFly does not let userland
map page 0) the result is the **panic/DoS**, not controllable corruption.
Threat model: attacker-controlled firmware or boot-loader environment
(loader.conf / cloud image / physical DMA), the same model under which the
acpi_madt family findings (DF-5430..5433) were filed. Severity Low,
CWE-476, per family calibration (boot panics = Low; DF-5432's arbitrary-
physical MMIO was the Medium outlier).

## Fix validation (fix.diff, applied in guest /usr/src, kernel #1 Oct 8 04:41:58)

* `make -j6 nativekernel KERNCONF=X86_64_GENERIC`: rc=0, `-Werror` clean.
* **Attack blob on patched kernel**: boots to ssh; decisive lines
  `ACPI FADT: SCI testing edge/high` → `ACPI FADT: SCI irq 0 is not
  available, disable`; `clk` ticking at ~250 Hz in `vmstat -i`; no panic, no
  DDB. (run.fixedkernel_attack.txt)
* **Control blob on patched kernel**: `ACPI FADT: SCI select level/high` —
  the normal mode-testing path is unaffected. (run.fixedkernel_control.txt)
* Baseline (stock kernel, same blob): Fatal trap 12 @ 0x28 (run.attack_panic.log).

fix_status: **fixed** (fix_baseline_reproduced=true, fix_patched_reproduced=false
— the panic itself is gone on the patched kernel).

## Negative results recorded during this audit (so the clean parts have weight)

* FADT field reads are bounds-safe in this file: SciInterrupt (offset 46) is
  only read after `Header.Length >= ACPI_FADT_V1_SIZE` (128, acpi_fadt.c:113),
  BootFlags (offset 109) only after `Length >= ACPI_FADT_V3_SIZE && Revision >= 3`
  (acpi_fadt.c:120-121). No V2..V6-specific field is consumed here at all.
* kgetenv/kfreeenv pairing on both trigger/polarity paths is balanced
  (acpi_fadt.c:134-162); no leak.
* The `machintr_legacy_intr_find(acpi_sci_irq, ...)`-before-`< 0`-check order
  wart (acpi_fadt.c:226-235) is cosmetic only: both ICU
  (icu_abi.c:664) and IOAPIC (ioapic_abi.c:967) implementations reject
  negative/out-of-range irq numbers, so a disabled SCI just logs a spurious
  "irq -1 is invalid" line.
* A short-FADT (`Length < 36`) KKASSERT panic candidate at acpi_fadt.c:103
  was **refuted live**: `sdt_search()` maps each candidate via
  `sdt_sdth_map()`, which returns NULL for Length<36 (acpi_sdt.c:147-148),
  so `sdt_search` skips such tables — `fadt_probe` prints "can't locate FADT"
  and the KKASSERT is unreachable from static table content.
* Reset-register and PM1a/b plumbing named in the task brief live in the
  ACPICA core (contrib scope, divergence-note only); this DFly file consumes
  only SciInterrupt, BootFlags, Revision and Length.
* Side observation (not this file, no finding filed): with `lapic_enable` on
  but no MADT, `start_all_aps()` spins forever in the
  `CPUMASK_CMPMASKNEQ(smp_lapic_mask, smp_startup_mask)` wait
  (mp_machdep.c:595-600) — a crafted-table boot hang in mp_machdep.c, noted
  for the acpi_madt/mp_machdep owners.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.