# DF-1331 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
NULL pointer dereference in attach error path when cfg is unset

## Source Location
sys/dev/sound/pci/envy24ht.c:2519-2562

## Verdict
Source-confirmed: NULL pointer dereference in attach error path when cfg is unset. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
envy24ht_pci_attach bad: path at :2527: if(sc->cfg->codec->destroy!=NULL). sc->cfg=NULL (bzero) when envy24ht_alloc_resource fails before envy24ht_init sets cfg. Same in detach at :2562. Malicious/defective PCI device or resource exhaustion. Sibling of DF-1322. Fix: check sc->cfg!=NULL && sc->cfg->codec!=NULL.