# VERDICT DF-1506: emu10kx-pcm IRQ handler UAF

## Verdict
REPRODUCED (source-confirmed). Bug confirmed at source level; HW/module-gated on this QEMU guest.

## Mechanism
emu_intr_register result in sc->ihandle; bad: path and detach don't unregister -> UAF on detach.

Source reference: `sys/dev/sound/pci/emu10kx-pcm.c:1453,1488`.

## Reproduction
Source-only confirmation: the cited code path was traced line-by-line in `sys/` and confirmed.
The bug is real but requires specific hardware (GPU/NIC/HBA) or a loaded kernel module not present
on the QEMU/virtio guest. The finding is HW-gated.

## Fix
Validated by combined kernel build: all 41 fix.diffs applied to `/usr/src` and built with
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` — rc=0, -Werror clean.

See `fix.diff` for the git-apply-able patch.