# DF-1260 PoC — AIOGCAP NULL-deref on d->mixer_dev (LATENT on guest; source-confirmed)

**Status:** source-confirmed real; NOT reproducible on audit guest (no audio HW).
**Impact:** NULL-deref panic (DoS) via `ioctl(AIOGCAP)` on `/dev/dsp` when a pcm
device has `mixer_dev==NULL` (mixer_init failed / detach race).
**Driver:** `sys/dev/sound/pcm/dsp.c` (sound subsystem; loads as module but no HW attaches).

## Reproduce
```
# load sound subsystem (creates /dev/dsp but no pcm device registers without HW):
ssh dfbsd 'kldload sound.ko'
./build.sh && ./run.sh    # reports open(/dev/dsp) failure: no audio hardware
```
The bug needs real audio HW + a mixer-less pcm device. See `VERDICT.md` + `fix.diff`.