{
  "finding_id": "DF-3998",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Reproduced via verbatim-code harness on the guest (no ICE1724/Envy24HT PCI device in QEMU, so live /dev/dsp trigger is hardware-gated): with the exact kernel constants, the second RECORD channels PCMTRIG_START offset (envy24ht.c:1721-1723, up to 4088 for S16_LE with attacker-chosen hw-ptr/blocksize) plus user-controlled freeptr makes the first r16sl loop iteration read sample32_t entries up to 32672 bytes PAST the 32768-byte record DMA buffer into the users record stream (kernel heap disclosure; full 32-bit words with S32_LE, low 16 bits with S16_LE), plus a 1-element (2-4 byte) OOB write past the kmallocd ch->data when freeptr is maximal. The play-direction twin (p8u/p16sl/p32sl writes attacker-controlled PCM up to 130024 bytes past the 131072-byte play DMA buffer) is present in the code but gated behind a second PLAY channel, which the driver does not register (envy24ht.c:2494-2505 registers exactly 1 play channel and chn_start refuses double-START) - latent, activates if the commented-out 5-play-channel registration is restored. Arithmetic deterministic; guard-page hard mode faults at the first OOB read. Fix validated at harness level: wrapping the phase-adjusted index before the first access (+ even alignment of the data-side pair index) eliminates all leaks, the data-side write and the fault.",
  "exploit_chain": "open /dev/dsp0.r0 (rec, 0666 clone) and start it -> open .r1, SETFMT S16_LE/S32_LE, SETFRAGMENT (blocksize 16 -> blk=8 dwords), read() enough to place freeptr, observe r0 hwptr via SNDCTL_DSP_GETIPTR -> trigger r1 START -> ch->offset up to 4088 (S16) while ssize=2048 -> every EMLDMARD leaks a 32-bit kernel word from up to ~32KB past the 32KB bus_dmamem rbuf into the users record stream; retrigger/reopen varies the offset -> repeatable unprivileged kernel heap disclosure. Live chain not executed: guest lacks the PCI device (hardware-gated). The complementary controlled-write primitive (play direction) is dormant on the shipped registration.",
  "evidence": "run.log ([C] offset=4088 -> 1 sample pair from +32672B past rbuf end, value 0xfee9 = low half of marker 0xDEADFEE9; data-side data16[8192] write; [D] play twin +130024B write 0xb9b90000), run.2.log (deterministic), run.hard.log (SIGSEGV at first OOB read), fix_run.log (patched: all zeros, no fault), VERDICT.md full trace",
  "kernel_refs": [
    "sys/dev/sound/pci/envy24ht.c:1721",
    "sys/dev/sound/pci/envy24ht.c:1714",
    "sys/dev/sound/pci/envy24ht.c:1324",
    "sys/dev/sound/pci/envy24ht.c:1330",
    "sys/dev/sound/pci/envy24ht.c:1357",
    "sys/dev/sound/pci/envy24ht.c:1366",
    "sys/dev/sound/pci/envy24ht.c:1399",
    "sys/dev/sound/pci/envy24ht.c:1405",
    "sys/dev/sound/pci/envy24ht.c:1429",
    "sys/dev/sound/pci/envy24ht.c:1435",
    "sys/dev/sound/pci/envy24ht.c:1459",
    "sys/dev/sound/pci/envy24ht.c:1465",
    "sys/dev/sound/pci/envy24ht.c:2160",
    "sys/dev/sound/pci/envy24ht.c:2494"
  ],
  "poc_changes": "Pass-2 reviewer authored the harness from scratch on the DF-3996 template: five emldma functions + trigger offset formula + gethwptr bounds verbatim from envy24ht.c with envy24ht constants (PLAY_CHNUM 8, REC_CHNUM 2, buffers 131072/32768 B); fixed-variant regenerated twice (arena aliasing bug in harness v1 scaffolding fixed by separating pbuf/rbuf canary arenas; even-alignment clamps added to kill the data-side pair straddle).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/emldmaht_harness emldmaht_harness.c",
  "run_cmd": "/tmp/emldmaht_harness (and: /tmp/emldmaht_harness hard)",
  "code_hash": "5820c0d9f552ed8fbc36a4ffc83dbc4ee863e5f8ccd80d05211312f4855ff751",
  "notes": "Hardware-gated live trigger (env.txt: envy24-pci-devs=0, no /dev/dsp nodes on guest). Record direction reachable unprivileged on real hardware (2+adcn >= 3 rec channels; second rec START always takes the offset branch). Play-direction write primitive latent behind the 1-play-channel registration (envy24ht.c:2494-2505); DF-3996 (envy24.c) proved the identical write chain live-capable with 5 play channels. DF-1330/DF-1331 (setrecsrc mixmap, attach-path NULL cfg) not re-reported.",
  "recommended_fix": "Wrap the phase-adjusted index before the first loop access in all five emldma functions and even-align the data-side pair index - see fix.diff",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff semantics applied to the verbatim harness functions: baseline 1 far-OOB read pair (+32672B) + 12 before-rbuf reads + data-side 1-element write + hard-mode guard fault; patched run reports 0 leaks, 0 OOB writes, no fault (fix_run.log). No kernel build performed (no envy24ht hardware to attach the driver on the guest); the diff is pure arithmetic wrapping, compile-trivial.",
  "fix_evidence": "findings/poc/DF-3998/fix_run.log; findings/poc/DF-3998/emldmaht_harness_fixed.c; findings/poc/DF-3998/fix.diff"
}