# DF-1322 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
NULL-pointer dereference at attach when Envy24 subsystem unknown and EEPROM absent

## Source Location
sys/dev/sound/pci/envy24.c:2409-2426

## Verdict
Source-confirmed: NULL-pointer dereference at attach when Envy24 subsystem unknown and E. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
envy24_init at envy24.c:2409: sc->cfg=NULL. :2422 if NULL, cfg=envy24_rom2cfg(sc) which returns NULL if EEPROM absent/short (<GPIODIR+1) or I2C read fails. :2426 sc->adcn=((sc->cfg->scfg&ADC)>>2)+1 derefs NULL -> page fault panic. Triggered when subvendor/subdevice not in cfg_table AND no EEPROM. Malicious/defective Envy24 PCI device (hotplug). Fix: check cfg!=NULL after rom2cfg, return ENXIO.