Summary

gpio_acpi_aei_handler at gpio_acpi.c:341-352 is ISR callback invoked by gpio_intel_intr; it queues deferred work via AcpiOsExecute(OSL_GPE_HANDLER, gpio_acpi_handle_event, arg) passing per-pin struct acpi_event_info *info (lives inside sc->infos[]) as context. AcpiOsExecute on DragonFly (OsdSchedule.c:118-144) does asynchronous lwkt_sendmsg to acpi_task_td thread which invokes func(at->at_context) at arbitrary later time with no synchronization back to caller. gpio_acpi_unmap_aei at :442-458 iterates for(i=0;i<num_aei;i++) calling GPIO_TEARDOWN_INTR (only masks IRQ at controller register per gpio_cherryview_disable_intr at gpio_cherryview.c:434-445, does NOT drain in-flight ISRs) and GPIO_FREE_INTR (gpio_intel_free_intr at gpio_intel.c:251-263, does NOT cancel queued AcpiOsExecute messages), then memset(info,0,sizeof(*info)) at :453, then kfree(sc->infos,M_DEVBUF) + sc->infos=NULL at :455-456. Author flagged with /* XXX Wait until ACPI Event handler has finished */ at :452 but never implemented the wait. gpio_acpi_handle_event at :309-339 runs asynchronously and does info->dev deref at :312/:317, either NULL-deref (after memset) or UAF read (after kfree). Trigger: local root detaches gpio_acpi (devctl detach or kldunload) while GPIO-backed ACPI event is firing. Cherry Trail / Bay Trail systems. Narrow window on edge-triggered pins, wider on level-triggered. Impact: kernel panic (local DoS) minimum.