{
  "finding_id": "DF-3999",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Reproduced via verbatim-code harness on the guest (hardware-gated live trigger: no ICE1724 device in QEMU). envy24ht_pci_attach registers 1 play + (2+adcn) rec channels (envy24ht.c:2494-2505) but the rec channels consume chanmap[1..] which are PLAY hw numbers (1,2,3,4) and REC_MIX/SPDIF (10,9); the record emulators compute slot=(ch->num-5)*2 giving slots -8..-2 and +8/+10 against a 2-entry frame. Every EMLDMARD on the first rec channel reads 8 sample32 entries (32 bytes) from BEFORE the 32KB record DMA buffer into the users record stream at offset 0 (harness case A: data[0]=0xabadbe08), and the 5th rec channel reads 10 entries (40 bytes) PAST its end (case B: data[8182]=0xdeadfe00) - unconditional, deterministic, unprivileged on real hardware. Deterministic across runs; slot clamp validated at harness level (0 leaks).",
  "exploit_chain": "open /dev/dsp0.r0 (0666 clone) and read(): every record DMA block leaks 32 bytes of kernel heap preceding sc->rbuf (and, on the 5th rec channel, 40 bytes past it) into the users PCM stream; repeatable indefinitely -> unprivileged kernel heap disclosure. Live chain not executed: guest lacks the PCI device (hardware-gated).",
  "evidence": "run.log cases [A] (8 samples from BEFORE rbuf, full 32-bit marker words) and [B] (10 samples from PAST rbuf end); run.2.log deterministic; fix_run.log (slot clamp: 0 leaks); VERDICT.md mapping analysis",
  "kernel_refs": [
    "sys/dev/sound/pci/envy24ht.c:2494",
    "sys/dev/sound/pci/envy24ht.c:2499",
    "sys/dev/sound/pci/envy24ht.c:2502",
    "sys/dev/sound/pci/envy24ht.c:1497",
    "sys/dev/sound/pci/envy24ht.c:1512",
    "sys/dev/sound/pci/envy24ht.c:221",
    "sys/dev/sound/pci/envy24ht.c:1432",
    "sys/dev/sound/pci/envy24ht.c:1435",
    "sys/dev/sound/pci/envy24ht.c:1462",
    "sys/dev/sound/pci/envy24ht.c:1465",
    "sys/dev/sound/pci/envy24ht.h:164"
  ],
  "poc_changes": "Shares the DF-3998 verbatim harness (cases [A]/[B] added for this finding); fixed variant carries the slot clamp % ENVY24HT_REC_CHNUM.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/emldmaht_harness emldmaht_harness.c",
  "run_cmd": "/tmp/emldmaht_harness",
  "code_hash": "5820c0d9f552ed8fbc36a4ffc83dbc4ee863e5f8ccd80d05211312f4855ff751",
  "notes": "Hardware-gated live trigger. Root cause distinct from DF-3998 (present at offset 0 on the FIRST channel open); DF-1330/1331 knowns untouched. Functional impact: record routing broken for all channels (wrong slots), which is why the bug survived.",
  "recommended_fix": "Clamp the record slot into the 2-entry frame: slot = ((ch->num - ENVY24HT_CHAN_REC_ADC1) * 2) % ENVY24HT_REC_CHNUM in r32sl/r16sl; structurally, register the designed 5 play channels so rec channels consume chanmap[5..] (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (slot clamp) applied to the verbatim harness together with the DF-3998 index wraps: baseline case A 8 before-rbuf leaks + case B 10 past-end leaks; patched run reports 0 leaks in both cases (fix_run.log). No kernel build (no envy24ht hardware on the guest); the clamp is compile-trivial.",
  "fix_evidence": "findings/poc/DF-3999/fix_run.log; findings/poc/DF-3999/emldmaht_harness_fixed.c; findings/poc/DF-3999/fix.diff"
}