# DF-1321 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25]

## Source Location
sys/dev/sound/pci/envy24.c:2038-2048

## Verdict
Source-confirmed: OOB read in envy24mixer_setrecsrc: recording-source bitmask used as ar. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
envy24mixer_setrecsrc at envy24.c:2042: ch=envy24_mixmap[src]. src is bitmask from SOUND_MIXER_WRITE_RECSRC after masking with recdevs=0x3e0 (bits 5-9). As index: src=0x40->64, 0x3e0->992 into 25-element array -> OOB read up to 3.9KB past .data. Value stored in never-read sc->src, ioctl returns bitmask not ch. No leak to userspace currently. Any user with /dev/mixer access. Fix: convert bitmask to index via ffs(src)-1.