diff --git a/infra/PROD-PROVISIONING.md b/infra/PROD-PROVISIONING.md
index c19e035..684d605 100644
--- a/infra/PROD-PROVISIONING.md
+++ b/infra/PROD-PROVISIONING.md
@@ -157,6 +157,61 @@ Same signature reported elsewhere: [Ubuntu LP #2039382](https://bugs.launchpad.n
 table) and [LP #1944019](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1944019) (**HP ZBook
 Studio G5**, 16 GiB → 1.5 GiB).
 
+### Will 6.12 ever get the fix? — researched 2026-09-02. **Not on its own.**
+
+| Question | Answer |
+|---|---|
+| In `linux-6.12.y` today? | **No.** Newest commit touching `memattr.c` on that branch is 2024-07-12. |
+| How long has it been available? | In mainline since **v6.13, 2025-01-19** — ~19 months and ~97 6.12.y point releases. |
+| Tagged `Cc: stable`? | **No.** Neither commit. |
+| Tagged `Fixes:`? | **No** — and this is structural, not an oversight. The unvalidated arithmetic has been there since the file was created in **2016**; it is not a regression, so there is no bad commit to point a `Fixes:` at. **Both automatic feeds — the `Fixes:`-scanning scripts and AUTOSEL — had nothing to grab.** |
+| Picked up by AUTOSEL? | **Never surfaced** for any branch. |
+| Has anyone asked? | **No.** Nothing on `stable@vger.kernel.org`, and nothing in all 8,027 open+archived Debian bugs against `src:linux`. We would be first. |
+| 6.12 LTS horizon | **EOL December 2028** — outlives Debian 13's own support window, so a backport is *not* time-barred. |
+
+**Every automatic path has already had its chance and produced nothing.** The probability that 6.12.y
+acquires this commit spontaneously is close to zero.
+
+**But the request is unusually strong, and the cost is one email.** The decisive card: the cherry-pick
+is **byte-clean**. Debian trixie 6.12.94-1's `drivers/firmware/efi/memattr.c` hashes to
+`164203429fa7a…`, **identical to the upstream patch's pre-image blob** — the file has not diverged at
+all between v6.12 and the commit's parent, so `git cherry-pick 8fbe4c49c0cc` applies with zero
+conflicts and zero adjustment. Neither the stable team nor Debian would have any backporting work to
+do, which removes the usual reason such requests are declined. The commit also meets every criterion
+in `stable-kernel-rules.rst`: in mainline, 17 insertions (limit 100 lines), fixes "a hardware quirk"
+and "a real bug that bothers people" — the enumerated categories.
+
+**Debian rebases**, so an upstream pickup reaches us automatically: trixie carries `linux 6.12.94-1`
+in *trixie-security* whose changelog opens *"New upstream stable update: ChangeLog-6.12.91"*. No
+action beyond `apt upgrade`.
+
+#### Plan
+
+1. **Run `trixie-backports` on both prod nodes now**, as an explicitly *provisional* measure. Any
+   6.13+ kernel carries the fix. Record the standing cost: backports packages are provided as-is,
+   without the main archive's security guarantees.
+2. **Email `stable@vger.kernel.org`** — this is `stable-kernel-rules.rst` Option 2 for an
+   already-merged patch. CC `linux-efi@vger.kernel.org` and **Ard Biesheuvel `<ardb@kernel.org>`**,
+   who both authored and committed the fix as EFI maintainer. Include: the commit ID and subject;
+   **6.12.y only**; the byte-clean-apply proof above (it pre-empts the main objection); and the
+   reproduction — three consecutive boots on one machine, two outcomes, **byte-identical
+   `BIOS-e820` across all three** (the detail that proves the divergence is in the MAT, not the
+   memory map), 16 GB → 2.6 GiB, plus a second identical machine taking the safe path only by
+   chance. Attach both dmesgs. Corroboration exists:
+   [Ubuntu LP #1944019](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1944019) (HP ZBook G5,
+   16 GiB → 1.5 GiB) and SUSE bugzilla 1231465, cited in the commit message itself.
+3. **File a Debian BTS bug as secondary**, against `src:linux` via `reportbug` (the bug-script
+   metadata is mandatory), severity `important`, referencing the lore thread. Debian's kernel
+   handbook §9.1.7 allows cherry-picking a patch already accepted upstream — which this is,
+   maintainer-authored with two Acked-bys — so if stable@ goes quiet Debian can act on its own.
+4. **Trigger to make the deviation permanent:** no stable@ pickup within ~2 release cycles (4–6
+   weeks) and no Debian movement ⇒ encode the backports kernel in the provisioning IaC for every
+   prod node and document it as a standing deviation from the distro baseline.
+
+**If patching by hand, only `8fbe4c49c0cc` is needed.** The follow-up `5d0faa8e8369` loosens a
+heuristic that was rejecting *legitimate* tables (false kexec warnings in Meta's fleet); it is not
+required for this symptom and depends on the first commit anyway.
+
 ### What NOT to do
 
 - **Do not buy RAM, move the DIMM, RMA the board, or run memtest expecting failures.** The DIMM is