DF-5669 — VERDICT

status: reproduced (privileged local; impact ceiling: dos) — confidence: certain for everything demonstrated below.

What reproduced (guest-live, 4/4 deterministic runs)

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC), QEMU i440FX, hw.acpi.supported_sleep_state: S3 S4 S5 (see env.txt).

1. Unprivileged boundary holds — open("/dev/acpi", O_RDWR) as uid 1001 → Permission denied (run.unpriv.log). Device is root:wheel 0644 (acpi.c:730), FWRITE checked at acpi.c:3424-3429.
2. The supported entry point is gated — ACPIIO_REQSLPSTATE S3 as root → errno 45 (Operation not supported) (run.reqstate.log), exactly the platform gate at sys/dev/acpica/acpi.c:2417-2420.
3. The deprecated ioctl bypasses the gate and lies. ACPIIO_SETSLPSTATE S3/S4 as root → ioctl() = 0, errno = 0 while dmesg gains acpi0: warning: acpi_SetSleepState() deprecated... + acpi0: device_suspend failed for every call (4 lines after 4 calls — run.log, dmesg.txt). So the kernel walked the whole device tree suspend path (with bus_generic_suspend's inline partial RESUME of already- suspended siblings, sys/kern/subr_bus.c:2894-2908) and then returned success for an operation that (a) is not supported on this platform and (b) failed.

Root cause of the false success: in acpi_EnterSleepState() (sys/dev/acpica/acpi.c:2557), status is set to AE_OK by AcpiGetSleepTypeData() (acpi.c:2597-2605); the DEVICE_SUSPEND != 0 branch only prints and breaks (acpi.c:2624-2627) without setting an error, so return_ACPI_STATUS(status) (acpi.c:2698) yields AE_OK → error = 0 at acpi.c:3455-3456.

What the deeper path would do (code-cited; blocked on this guest)

On this guest a driver deterministically vetoes DEVICE_SUSPEND (silent error; identity not attributed), so the flow stops at stage 2 of 5 (ACPI_SS_GPE_SET). On suspend-clean hardware the same ioctl continues:

• AcpiEnterSleepStatePrep(state) — _PTS + SLP_TYP written to PM1 control (acpi.c:2630-2636);
• acpi_sleep_machdep(sc, state) — no-op stub on pc64 (sys/platform/pc64/acpica/acpi_wakeup.c:51-54); its return value is ignored. On real FreeBSD this function is the actual sleep transition (wake APs, save CPU state, AcpiEnterSleepState from the trampoline); here nothing sleeps;
• slp_state = ACPI_SS_SLEPT unconditionally (acpi.c:2653);
• backout: AcpiLeaveSleepState(state) (PM1-control writes, WAKE_STATUS clears, _WAK — sys/contrib/dev/acpica/source/components/hardware/ hwsleep.c:408-479) and DEVICE_RESUME(root_bus) (acpi.c:2669-2673) on a machine that never slept;
• ICU/ELCR/LAPIC state is never resynced after the phantom cycle: icu_reinit() (sys/platform/pc64/icu/icu.c:128) and elcr_resume() (sys/platform/pc64/icu/elcr.c:121) have zero callers (the latter is already tracked as DF-5654 — not re-reported here).

This is a full device-tree teardown/rebuild driven through an entry point the platform explicitly declares unsupported — unvalidated on pc64 by design of the stubs.

Why not uid0 / not a panic

Not memory corruption — a control-flow/logic defect with a privileged-only entry. No unprivileged route exists (proven). On this guest the driver veto prevents the phantom stages, so no wedge/panic was observable; the impact ceiling on capable hardware is a wedged/half-resumed system (privileged DoS).

Fix

Route the deprecated ioctl through the same gate as the modern one (fix.diff): acpi_ReqSleepState(sc, state) already implements the platform policy (S5 allowed → poweroff; S1–S4 → EOPNOTSUPP; range → EINVAL). Also worth a follow-up in acpi_EnterSleepState(): set status = AE_ERROR on the device_suspend failed break so failures are never masked.

Fix validation: not tested — this is a Low-severity logic finding, not a reproduced memory-corruption bug, so the single-fix kernel rebuild cycle was not warranted per the audit contract. The diff is trivially reviewable against acpi.c:3451-3456.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.