Summary

AcpiOsReadPciConfiguration masks return value with (1 << (bytes*8)) - 1 where 1 is signed int (OsdHardware.c:106). For Width=32 (bytes=4) evaluates 1<<32 undefined behavior per C11 6.5.7 (1*2^32 not representable in int). On x86_64/GCC shl wraps count mod 32 yielding 1<<0-1=0 so *Value &= 0 and every 32-bit ACPI PCI-Config read silently returns 0 instead of register contents. Downstream pci_cfgregread returns CORRECT full 32-bit value via inl/volatile u32 ptr which mask then destroys. Mask redundant for bytes=1/2 (pci_cfgregread returns correctly-sized via inb/inw) actively destructive for bytes=4. Triggered whenever ACPICA interpreter evaluates AML reading 32-bit field from PciConfig OpRegion; AcpiExPciConfigSpaceHandler passes BitWidth through unchanged pre-zeroes Value. BIOS DSDT/SSDT commonly reads 32-bit PCI config fields (BAR registers class codes status/command DWORDs) during device probe hotplug PM transitions. Impact: reads return 0 causing incorrect device configuration failed init ACPI method malfunction local DoS/integrity. Requires ability to drive ACPI method evaluation (kernel-internal boot/probe or root /dev/acpi) not reachable by unprivileged userspace. No memory corruption info leak or priv-esc.