# DF-5620 VERDICT

**REPRODUCED** (logic bug live-demonstrated with a differential control;
fix validated by kernel rebuild).

## What was run

The planted-ACPI rig (see DF-5619 pack) carrying `_CST` = valid C1 + a C2
FixedHardware/native descriptor (Intel FFH encoding, BitWidth=1 vendor,
BitOffset=2 class, Address=0x99999971 = mwait hint arg0) whose hint is
INVALID: `MWAIT_EAX_TO_CX(0x99999971) = 8 >= CPU_MWAIT_CX_MAX`.
Because QEMU 7.2 never advertises CPUID.05H.ECX.EXT (leaf ECX = 0x2,
INTBRK only, under both TCG and KVM) and also masks CPUID.01H:ECX.MON,
the stock code would EOPNOTSUPP at acpi_cstate_machdep.c:149-153 before
reaching the code under test.  The `mwaitforce.ko` helper therefore ORs the
missing advertisement bits into `cpu_feature2`/`cpu_mwait_feature` from a
SYSINIT at SI_SUB_CONFIGURE/SI_ORDER_FIRST — after every CPU's
identify_cpu() has written those globals (they are clobbered per-CPU at
identcpu.c:645/649; a first attempt forcing at SI_SUB_DRIVERS was silently
undone by the APs) and immediately before acpi0/cpu_cst probe.  This is the
same "substitute ONLY the missing CPUID advertisement" methodology as
DF-5483's estforce.ko; everything after the substitution is the genuine
stock driver.  (cpu_mwait_cx_info[] subcnts remain zero because
cpu_mwait_attach() bailed earlier — irrelevant here: the scenario IS the
invalid-hint rejection; and the default idle hook stays the static
"sti; hlt", so the late feature words cannot destabilize boot idle.)

## Observations (exact)

1. **control** (C1-only `_CST` + mwaitforce): full boot,
   `machdep.mwait.CX.c3_preamble: 3`, zero mwait console lines.
2. **attack** (C1 + badhint C2 + mwaitforce): full boot, console shows
   `C2 -> cpu specific C8 sub state 1` + `C2: invalid mwait hint 0x99999971`
   for each CPU — the descriptor is REJECTED (cx_supported stays "C1/1")
   — but `machdep.mwait.CX.c3_preamble: 0`: the done: block ran
   `cpu_mwait_cx_no_bmsts()` twice (AccessWidth lacks the BM_STS bit;
   deep-mapping block) and `cpu_mwait_cx_no_bmarb()`, clearing BOTH the
   BM_STS and BM_ARB bits of the global C3 preamble that governs the
   machdep MWAIT idle loop's C3 entry discipline on every CPU.
   (run.attack_sysctl.txt)
3. **fixed kernel** (fix.diff: rejection returns EINVAL before any side
   effects): same attack blob, same module — rejection lines unchanged,
   `c3_preamble: 3`.  Side effects gone.  (run.fixedkernel_badhint.txt)

## Impact ceiling

Firmware/AML-controlled degradation of C3 power-management discipline
system-wide (on pre-Core2 MP Intel platforms, entering C3 without the
BM_STS check / arbitration disable risks the cache-coherency hazards the
PIIX4-era quirks in this very driver exist to work around).  No memory
corruption, no user-triggerable path; the demonstrated artifact is the
global preamble corruption itself.  Severity Low.

## Fix validation

fix.diff rewrites the error path: invalid hint -> `return EINVAL`
(no side effects); the BM fixups run only on the success path; behavior
for valid descriptors unchanged.  Applied (with DF-5619's fix) in the
guest's /usr/src, kernel rebuilt -Werror-clean, rebooted:
attack blob → `c3_preamble: 3` (was 0), `invalid mwait hint` still printed
(rejection semantics preserved), guest healthy.  Baseline vs patched: the
rejected descriptor no longer mutates global state.  Fix validated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.