{
  "finding_id": "DF-5745",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED twice on-guest with production code: apple_gmux_attach sets the shared global apple_gmux_softc_data unconditionally (apple-gmux.c:867), so a second APP000B ACPI device overwrites it, then fails vga_switcheroo_register_handler with -EINVAL and its error path NULLs the global unconditionally (apple-gmux.c:894) while the first instances handler remains registered. Any dispatch then writes through NULL in gmux_switchto (apple-gmux.c:511): observed Fatal trap 12, fault virtual address = 0x60, supervisor write data, Stopped at gmux_switchto+0x10: movl %edi,0x60(%rbx) with the shipped /boot/kernel/apple_gmux.ko, on two independent planted-ACPI rigs (4-port and valid-length 0x78 _CRS). handler_flags=0x1 (CAN_SWITCH_DDC) proves i915s boot path (i915_drv.c:742 -> vga_switcheroo_force_migd -> handler->switchto) hits the same trap spontaneously at DRM load on an affected machine. Precondition is two APP000B devices (crafted/malicious ACPI or firmware bug), not unprivileged-reachable -> Low severity, panic/DoS impact. fix.diff (NULL guards + ownership of the global) validated on the same rig: force_migd returned 0, NO PANIC, guest stays up, surviving instance functional.",
  "exploit_chain": "crafted ACPI with two APP000B gmux devices -> kldload apple_gmux (or boot with modules) -> instance 1 attaches + registers vga_switcheroo handler -> instance 2 attaches, overwrites global at :867, register_handler returns -EINVAL, error path NULLs global at :894 -> any switcheroo dispatch (i915 load at i915_drv.c:742, /dev/vga_switcheroo write, DRM lock_ddc) -> gmux_switchto writes enum to NULL+0x60 -> fatal page fault -> kernel panic (DoS). Fixed offset/value store; not a controllable-memory-corruption primitive.",
  "evidence": "panic.txt + panic.b2.txt (identical signatures on both rigs: gmux_switchto+0x10 movl %edi,0x60(%rbx)); run.log (full decisive run incl. apple_gmux1 attach returned -22 then trap); fix_validation.log (baseline panic; step-1 fix -19 no panic; complete fix return 0 no panic, uptime shown)",
  "kernel_refs": [
    "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:130",
    "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:509",
    "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:867",
    "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:892",
    "sys/dev/video/vga/vga_switcheroo.c:237",
    "sys/dev/drm/i915/i915_drv.c:738"
  ],
  "poc_changes": "Seed had no runnable rig. Built hand-encoded AML SSDT generator (two APP000B devices; readable non-0xff QEMU ports 0x92/0x4d0 chosen so the classic path is taken to full attach) and a trigger KLD invoking the production vga_switcheroo_force_migd() path i915 uses. Second rig with valid 0x78-length regions to decouple from DF-5744. Fixed a redundant-declaration build error in the trigger (header already declares force_migd); DDB-hung guest hard-kills lost un-synced .ko files once (rebuilt).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2100,
  "guest_dirty": 1,
  "build_cmd": "guest: cd /root/gmuxtrig_b && make",
  "run_cmd": "boot QEMU_EXTRA=-acpitable file=ssdt_b.aml; guest: kldload apple_gmux; kldload /root/gmuxtrig_b/gmuxtrig.ko",
  "code_hash": "f15e9758dac94c1bf8ea71d943051608364cebbbc953bd66582c00206b165613",
  "notes": "Same DF-2228-class lifetime issue (AcpiRemoveNotifyHandler without drain) also exists on the attach-error path (apple-gmux.c:897-900) - not re-reported. Adjacent issues in vga_switcheroo.c itself (force_migd handler NULL-check, negative errno from d_write) noted for a future pass of that file. Guest reset with-src run after this verification.",
  "recommended_fix": "Guard the three handler callbacks against a NULL apple_gmux_softc_data, take ownership of the global only if still NULL at :867, and clear it on error/detach only when this softc owns it (see fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Identical rig + trigger: unpatched module panics (gmux_switchto+0x10, fault va 0x60); module rebuilt with fix.diff returns cleanly (force_migd returned 0, NO PANIC, guest up 18s+ at check). Intermediate guard-only variant returned -19 without panic, proving the ownership hunk is needed for a functional (not merely non-crashing) handler.",
  "fix_evidence": "findings/poc/DF-5745/fix_validation.log; panic.b2.txt; fix.diff"
}