DF-2177

acpi_PkgStr NULL-pointer dereference via firmware-supplied zero-length String/Buffer (kernel DoS)

Summary

acpi_PkgStr reads element String.Pointer/Buffer.Pointer into ptr without testing NULL then calls strlcpy(dst ptr length). For zero-length ACPI Buffer (Buffer(0){} in AML) ACPICA deliberately sets Buffer.Pointer=NULL Buffer.Length=0 (dsobject.c:365-370) so length becomes 1 after ++length>size check at line 95 and strlcpy invoked as strlcpy(dst NULL 1). DragonFly strlcpy unconditionally dereferences src via while(*s++) (strlcpy.c:59-60) even when siz==1 so unconditional kernel page-fault/panic. Only in-tree caller acpi_cmbat (acpi_cmbat.c:374-380) extracting _BIF/_BIX model/serial/type/OEM from battery device firmware exposes. Malicious/buggy ACPI table returning zero-length Buffer/String panics kernel at boot or battery-info refresh. Attacker: crafted ACPI SSDT (qemu -acpitable or cloud/VM guest-influenced ACPI) defining PNP0C0A battery _BIF with Buffer(0){} in string slots. Impact immediate kernel panic DoS no code exec no info leak no priv-esc. Reachable default config whenever battery device present.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:N/I:N/A:H
CWE: CWE-476 NULL Pointer Dereference
File: sys/dev/acpica/acpi_package.c
Lines: 76-98
Area: dev
Discovered: 2026-07-26
Updated: 2026-07-26

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: likely
Tested: 2026-07-26 18:05:07
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-26 18:05:07
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-2177/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2177 · 4 files

File	Type	Size
VERDICT.md	file	743 B	↓ raw
build.sh	file	161 B	view raw
fix.diff	file	166 B	view raw
run.sh	file	80 B	view raw

VERDICT.md file

↓ download raw

DF-2177 - Verification Verdict

Status: reproduced (source-confirmed) Impact: panic Confidence: likely

Verdict

Source-confirmed: acpi_PkgStr (:83-98) reads String/Buffer Pointer into ptr without NULL test; strlcpy(dst,ptr,length) with ptr=NULL; zero-length Buffer has Pointer=NULL; ACPI-gated

Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

Source File

sys/dev/acpica/acpi_package.c

Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors). The combined patch is at findings/poc/batch_build/all_fixes.patch.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

batch build rc=0

batch build rc=0

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

acpi_PkgStr strlcpy NULL ptr; ACPI-gated

Verified recommended fix

acpi_PkgStr strlcpy NULL ptr; ACPI-gated

Verdict

acpi_PkgStr strlcpy NULL ptr; ACPI-gated