Summary

acpi_dock_attach L518-519 AcpiInstallNotifyHandler(h,ACPI_ALL_NOTIFY,acpi_dock_notify_handler,dev). acpi_dock_detach L524-533 only sysctl_ctx_free never calls AcpiRemoveNotifyHandler. device_detach subr_bus.c:2150 device_set_driver(dev,NULL) kfree softc subr_bus.c:1943-1945; kldunload also unmaps acpi_dock_notify_handler text page. Handler registration persists on namespace node. Next ACPI notification dispatches handler with context=dev -> freed memory. device_get_softc(dev) returns NULL/reclaimed; sc->status deref -> page fault/panic. After text unmap control jumps to freed/unmapped address. Root-only trigger (SYSCAP_NOKLD kern_linker.c:841 gates kldunload; securelevel>0 blocks). After kldunload acpi_dock any ACPI event (lid/suspend/resume/dock) dispatches stale handler. Local kernel DoS panic; theoretical code-exec with heap grooming. Sole outlier: every sibling ACPI driver pairs install/remove (acpi_thermal/video/thinkpad/wmi/asus/panasonic/fujitsu/cmbat/toshiba all paired). Fix: AcpiRemoveNotifyHandler in detach under dock serial lock. [PASS-2 NOTE: DF-1905 and DF-2380 are duplicate rows for one root cause (same lines); mechanism live-verified for the first time in the DF-4823 pack; fix = the DF-4823 OSL-drain + RemoveNotifyHandler set]

PoC verification

Evidence pack

findings/poc/DF-1905 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	410 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1905 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: acpi_dock_attach L518-519 AcpiInstallNotifyHandler(h,ACPI_ALL_NOTIFY,acpi_dock_notify_handler,dev). acpi_dock_detach L524-533 only sysctl_ctx_free never calls AcpiRemoveNotifyHandler. device_detach su

Citation: sys/dev/acpica/acpi_dock/acpi_dock.c:518-533

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: missing AcpiRemoveNotifyHandler in detach leaves dangling handler (acpi_dock.c:518-533)

Verified recommended fix

Source-confirmed: missing AcpiRemoveNotifyHandler in detach leaves dangling handler (acpi_dock.c:518-533)

Verdict