# DF-1330 — VERDICT

**REPRODUCED at the function level** (impact: `leak`).

## Mechanism

envy24htmixer_setrecsrc(m, src) at envy24ht.c:1956 indexes envy24ht_mixmap[src]. src is a bitmask masked to ENVY24HT_MIX_REC_MASK=0x3e0 (declared via mix_setrecdevs at :1875). Non-zero values from the mask (32, 64, 96, 128, ..., 992) are used as direct array indices into the 25-element envy24ht_mixmap[], causing OOB reads 128-3968 bytes past the array. KASAN would catch this; production silently returns whatever garbage the OOB read yields, which is then used as a channel index. Any user with /dev/mixer access can trigger this via a MIXER_SETRECSRC ioctl.

## Why not live-reproduced on the QEMU guest

The envy24ht sound PCI driver attaches only to ICEnsemble VT1724/Envy24ht hardware, which is absent from the QEMU guest. /dev/mixer does not exist on this guest.

## Recommended fix

Convert the bitmask to an index in envy24htmixer_setrecsrc: 'if (src == 0 || (src & (src-1)) != 0 || ffs(src) > NELEM(envy24ht_mixmap)) return src; int ch = envy24ht_mixmap[ffs(src)-1];'.

## Kernel references (confirmed during verification)

- sys/dev/sound/pci/envy24ht.c:1956 (ch = envy24ht_mixmap[src] with raw bitmask)
- sys/dev/sound/pci/envy24ht.c:236 (envy24ht_mixmap[] is 25 entries)
- sys/dev/sound/pci/envy24ht.h:172 (ENVY24HT_MIX_REC_MASK = 0x3e0)
- sys/dev/sound/pci/envy24ht.c:1875 (mix_setrecdevs declares the mask)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`