# DF-1261 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race)

## Source Location
sys/dev/sound/pcm/dsp.c:2370-2520

## Verdict
Source-confirmed: dsp_clone uses function-static cdev pointer shared across concurrent c. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
dsp_clone at dsp.c:2381: static struct cdev *dev = NULL. snd_clone_alloc at :2495 reads/writes *dev. make_only_dev at :2506 writes. ap->a_dev=dev at :2520 reads. devfs drops devfs_lock before calling clone handler (devfs_core.c:2333) -> two opens race on shared pointer. Result: wrong cdev returned, orphaned cdev leak. Fix: make dev a local.