DF-2388
Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class
Summary
acpi_panasonic_detach() calls AcpiRemoveNotifyHandler() then frees sysctl context returns. On DragonFlyBSD AcpiOsWaitEventsComplete() defined as empty no-op so AcpiRemoveNotifyHandler does NOT wait for notify dispatch already in flight on another thread. Same DF-2381-class defect present in every sibling acpi_* hotkey driver. In THIS specific driver does not produce demonstrable UAF: device_t and softc persist after detach (orphaned ACPI-bus children until device destruction) in-flight notify path dereferences only sc->dev and sc->handle which remain valid. Residual risk is logic/ordering hazard not memory-corruption UAF.
No comments yet.