# DF-3867 VERDICT

**Status: `untested`** (contract skip: Low/speculative; hardware gate identical to DF-3866 —
guest has no Creative Labs PCI device, `snd_emu10kx` loads but never attaches).

## Source-level race

- `emu_intr()` (emu10kx.c:980-1033) is registered `INTR_MPSAFE`
  (emu10kx.c:3208) and iterates `ihandler[]` **without any lock**:
  - :995 `((void *)sc->ihandler[i].irq_func) != NULL`  ← load #1
  - :996 `ack |= sc->ihandler[i].irq_func(...)`        ← load #2 + indirect call
- `emu_intr_unregister()` (:948-978) holds `sc->lock` and NULLs
  `.irq_func`/`.softc` (:966-967) — the lock does not exclude the hardirq.

A record-channel STOP (unprivileged `/dev/dsp` user, emu10kx-pcm.c:992/1162)
landing between load #1 and load #2 → call through NULL → guaranteed panic.

Impact ceiling: kernel DoS (panic). Not exploitable control flow.
Fix: read `irq_func`/`softc` once into locals (compiler barrier / lock
snapshot) before testing and calling.

Not run at runtime; `trigger.c` documents the exact trigger shape for
reproduction on real hardware.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)