Summary

sysctl_acpi_sony_gen_handler() declares int val; without initializing (acpi_sony.c:183) calls acpi_GetInteger() while discarding return status (lines 185-186) then unconditionally passes &val to sysctl_handle_int() which copyout()s 4 bytes to userspace on every read (acpi_sony.c:187). When underlying ACPI get-method (GCTR for contrast GMGB for bass_gain frequently absent on real Sony VAIO) does not exist or returns non-integer acpi_GetInteger never writes *number so 4 bytes returned are live uninitialized kernel stack. sysctl_root does NOT privilege-check reads (kern_sysctl.c:1438-1450 only gates writes req->newptr!=NULL) so any local unprivileged user can read hw.acpi.sony.<node> and harvest stack bytes. Leaked bytes commonly contain kernel text/data pointers from prior syscall frames useful as KASLR oracle or input to larger exploit chain. acpi_GetInteger (acpi.c:2162-2204) only writes *number on ACPI_SUCCESS && ACPI_TYPE_INTEGER path; every other path (AE_NOT_FOUND AE_TYPE) leaves untouched. Attacker: local unprivileged on Sony VAIO with SNY5001 ACPI device. Reach: sysctl hw.acpi.sony.contrast (or any OID whose get-method absent on specific HW). Impact: 4 bytes uninitialized kernel stack per read repeatable indefinitely no priv-esc no integrity/availability impact standalone.