# DF-1393 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (module not loaded, not reachable as maxx)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

seq_fetch_mid at :724: `if (unit > scp->midi_number || unit < 0)` should be `>=`. scp->midis[] is populated for indices [0..midi_number-1]; midis[midi_number] is NULL (M_ZERO allocation). Callers dispatch NULL kobj via SYNTH_ALLOC, dereferencing ops at 0x0 → kernel panic. midi_number can be 0 (no MIDI hardware needed), so unit=0 triggers the bug.

**Source:** `sys/dev/sound/midi/sequencer.c:724`

## Why it cannot be reproduced on this guest

NOT reachable as maxx. The sound/midi module is not in GENERIC and not loaded. No /dev/sequencer* or /dev/music* device nodes exist. Would require `kldload` (root-only). Device perms are 0666 but device does not exist on this guest.

## Phase 6: Escalation Assessment

This is a **Module-not-loaded (midi sequencer)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Change `>` to `>=` in seq_fetch_mid.

**Fix description:** Change `unit > scp->midi_number` to `unit >= scp->midi_number` in seq_fetch_mid.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)