DF-2591 — PoC evidence pack

Finding: acpi_panasonic_shutdown() calls hkey_sound_mute() without ACPI_SERIAL_BEGIN(panasonic) (acpi_panasonic.c:231); hkey_sound_mute() opens with ACPI_SERIAL_ASSERT(panasonic) (:374) which expands to KKASSERT(lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE) (sys/dev/acpica/acpivar.h:172) — guaranteed panic on INVARIANTS kernels at every shutdown/reboot of a system with this device.

Rig

Same verbatim-interposition kernel harness as DF-2386 (see that README). Two real triggers:

• A (run.sh baseline cmd): hw.panasim.cmd=9 makes the rig worker call device_shutdown(dev) — the same subr_bus dispatch (sys/kern/subr_bus.c:2154-2162) the reboot path uses for every device (MOD_SHUTDOWN → device_shutdown(root_bus) → bus_generic_shutdown, subr_bus.c:3549-3551, :2883-2890).
• B (run.sh baseline reboot): root reboot end-to-end.

Build

sh build.sh            # shared with DF-2386

Run

sh run.sh baseline cmd      # trigger A: device_shutdown -> assert panic
sh run.sh baseline reboot   # trigger B: real reboot -> assert panic
sh run.sh fixed   cmd|reboot  # fixed: no assert; clean shutdown

Expected result (baseline)

KKASSERT panic naming the panasonic serial (lockstatus ≠ LK_EXCLUSIVE) inside acpi_panasonic_shutdown→hkey_sound_mute, on the INVARIANTS stock-style kernel. Fixed build: no assert, device_shutdown returns, reboot completes cleanly.

DF-2591 — PoC verdict

File: sys/dev/acpica/acpi_panasonic/acpi_panasonic.c (:231, assert at :374)

Verdict: REPRODUCED — acpi_panasonic_shutdown() calls hkey_sound_mute() without ACPI_SERIAL_BEGIN(panasonic); the callee opens with ACPI_SERIAL_ASSERT(panasonic) (:374) which expands to KKASSERT(lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE) (sys/dev/acpica/acpivar.h:172) — a guaranteed panic on INVARIANTS kernels at every shutdown/reboot of a system with this device, plus an unsynchronized SSET evaluation racing concurrent sysctl/notify on production kernels. Both triggers verified through the real code path; fixed build shuts down cleanly (A/B validated).

Line-accurate confirmation

1. acpi_panasonic.c:222-233 — acpi_panasonic_shutdown: sc = device_get_softc(dev); mute = 1; hkey_sound_mute(sc->handle, HKEY_SET, &mute); — no ACPI_SERIAL_BEGIN anywhere in the function; every other caller path takes the serial (acpi_panasonic_sysctl :248/:262, acpi_panasonic_notify :487/ :492, acpi_panasonic_power_profile :509/:512).
2. acpi_panasonic.c:370-374 — hkey_sound_mute opens with ACPI_SERIAL_ASSERT(panasonic).
3. sys/dev/acpica/acpivar.h:172 — the assert is a plain KKASSERT (unconditional in the header), active on INVARIANTS kernels.
4. Reboot chain: root reboot → boot() → module MOD_SHUTDOWN → device_shutdown(root_bus) (sys/kern/subr_bus.c:3549-3551) → bus_generic_shutdown (:2883-2890) → DEVICE_SHUTDOWN dispatch (device_shutdown, :2154-2162) → verbatim acpi_panasonic_shutdown.

Mechanical verification

Same rig as DF-2386 (see that VERDICT). Two real triggers:

• A — device_shutdown(dev) (the same subr_bus dispatch the reboot path uses; hw.panasim.cmd=9 runs it in the rig worker):

panic: assertion "lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE" failed in hkey_sound_mute at /usr/src/sys/dev/acpica/panasim/acpi_panasonic_verbatim.c:374
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdd659(%rip)

The KKASSERT names the lock, the function, and line 374 of the verbatim file (path proves the assertion fired inside the verbatim driver code).

• B — real reboot end-to-end (root), full backtrace captured (panic_reboot.txt):

boot() called on cpu#2
Switching to cpu #0 for shutdown
...
syncing disks... done
panic: assertion "lockstatus(&panasonic_serial, curthread) == LK_EXCLUSIVE" failed in hkey_sound_mute at ...acpi_panasonic_verbatim.c:374
Trace beginning at frame ...
hkey_sound_mute() at hkey_sound_mute+0xb9
acpi_panasonic_shutdown() at acpi_panasonic_shutdown+0x23
bus_generic_shutdown() at bus_generic_shutdown+0x53
acpi_shutdown() at acpi_shutdown+0x9
bus_generic_shutdown() at bus_generic_shutdown+0x53
Debugger("panic")

Exactly the claimed path: reboot → acpi bus shutdown → device shutdown → mute → assert. The panic fires mid-shutdown after disks synced (a recursive-panic-prone moment, as the finding notes).

Reachability / privesc assessment (honest)

• Hardware precondition: Panasonic MAT0019 firmware. Trigger: root reboot/halt (PR:H in the CVSS) — on an INVARIANTS kernel with this driver attached, the assert fires on EVERY shutdown (deterministic, no race needed).
• Production (non-INVARIANTS) kernels: the assert compiles out; the residual defect is acpi_panasonic_sset (SSET evaluation) running unlocked against concurrent sysctl/notify holders of the serial — a real but narrow protocol violation (CWE-667).
• Impact: panic/DoS at shutdown; no memory corruption; not a privesc. Low severity upheld.

Fix validation (A/B)

Fixed kernel (#6), fix.diff hunk wrapping the mute in ACPI_SERIAL_BEGIN/END:

• trigger A: rig ring records worker: device_shutdown returned (no assert fired) (run_fixed.log);
• trigger B: root reboot → clean shutdown, grep -c panic over the full serial log = 0, guest cycles and returns on its own.

Artifacts

run_fixed.log, panic_reboot.txt (trigger B, full assert + backtrace), serial.txt (fixed-run serial), rig sources, build.sh/run.sh, build.log, fix.diff, env.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.