{
 "finding_id": "DF-3997",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "likely",
 "impact": "NULL deref (sc->cfg->codec) on the envy24 attach error path when resource allocation fails before envy24_init assigns sc->cfg \u2014 panic during device attach. Privileged/physical context only. Mirror of DF-1331 (envy24ht.c) on a distinct trigger path; distinct from DF-1322.",
 "verdict": "source-verified; PoC skipped per contract (Low, no unprivileged trigger)",
 "exploit_chain": [],
 "evidence": "static path: envy24.c:2570 goto bad before sc->cfg assigned at 2409-2425; cleanup derefs sc->cfg->codec at 2623",
 "kernel_refs": [
  "sys/dev/sound/pci/envy24.c:2569",
  "sys/dev/sound/pci/envy24.c:2623"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-3997/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "guard the codec-destroy loop with if (sc->cfg && sc->cfg->codec && sc->cfg->codec->destroy != NULL) \u2014 same guard as the envy24ht.c sibling fix for DF-1331",
 "fix_evidence": "source-only"
}