# DF-3941 — cxm(4): unlocked ring consumption in cxm_read() → size_t underflow → OOB kernel-heap read via read(2)

**File:** `sys/dev/video/cxm/cxm.c` (pass 2)
**Severity:** Medium · **Confidence:** likely · **Hardware-gated** (needs a CX23415/CX23416 capture card to drive the DMA ring)

## Build

```
cc -O2 -Wall -o /tmp/cxm_read_race cxm_read_race.c
```

(guest: DragonFly 6.5-DEVELOPMENT, cc 8.3 — builds clean)

## Run

```
/tmp/cxm_read_race
```

## Expected

* **On real hardware** (PVR-250/350, capture running): the forked racing
  readers trigger the ring-state desync; success criterion = read() data that
  cannot come from the DMA ring (non-MPEG-framed bulk data / kernel heap
  contents), or reads of never-DMA'd buffers.
* **On the audit QEMU guest**: `open("/dev/cxm0"): No such file or directory`
  — the guest has no Conexant PCI device (verified: no 14f1:8800/8802 on the
  PCI bus, no cxm module, no /dev/cxm*). This is the documented, honest
  outcome of the run on this machine (see run.log).

## Contents

* `cxm_read_race.c` — trigger source (forked racing readers, partial-read
  offsets, anomaly detector)
* `build.sh` / `run.sh` — exact commands
* `build.log` / `run.log` — full untrimmed guest output
* `env.txt` — guest uname + hardware-absence evidence + patched-source proof
* `fix.diff` — git-apply-able fix (driver lock + defensive offset clamp),
  compile-validated against the guest kernel tree (fix_build.log)
* `VERDICT.md`, `manifest.json`, `verdict.json`