# DF-4094 — emu10k1 attach-failure path leaks emu_init DMA allocations + mpu401 state

File: `sys/dev/sound/pci/emu10k1.c` (pass 2, GLM 5.3)

## What

`emu_pci_attach()` calls `emu_init(sc)` at sys/dev/sound/pci/emu10k1.c:2114.
On success `emu_init()` has allocated and programmed:

- `sc->mem.ptb_pages`  — EMUMAXPAGES*4 = 2048 bytes of bus_dmamem (emu10k1.c:1891-1892)
- `sc->mem.silent_page` — 4096 bytes of bus_dmamem (emu10k1.c:1896-1897)

After that, three more steps can still fail and jump to `bad:`:

- `AC97_CREATE()` == NULL            (emu10k1.c:2119-2120)
- `mixer_init()` == -1               (emu10k1.c:2122)
- IRQ alloc / `snd_setup_intr()`     (emu10k1.c:2127-2133)
- additionally `emu_midiattach()` has already run (emu10k1.c:2124), so
  `sc->mpu` (kmalloc'd mpu401 + midi unit) is live too.

The `bad:` path (emu10k1.c:2149-2157) destroys codec/reg/irq/dmat/lock and
frees `sc`, but **never calls `emu_uninit()`**, so the two DMA pages
(~6 KB of coherent memory per failed attach) and the mpu401/midi structures
leak. `emu_init()`'s own internal failure paths free their allocations
correctly (emu10k1.c:1893-1901) — the leak is exclusively the late-failure
window.

## Threat model

Requires an emu10k1/emu10k2/emu10k3 PCI card whose attach fails *late*
(e.g. shared-IRQ resource exhaustion, AC97 codec probe failure).
Privileged/hardware-gated; impact is a kernel-memory leak per attach
attempt (attach retries on bus rescans repeat the leak). No memory
corruption, no info leak to userspace.

## Source trace (certain, source-level)

1. emu10k1.c:2114 `if (emu_init(sc) == -1) goto bad;`  — success continues
2. emu10k1.c:1891-1901 emu_init allocates ptb_pages + silent_page (kept on success)
3. emu10k1.c:2119-2133 any of AC97_CREATE / mixer_init / irq alloc fails → `goto bad`
4. emu10k1.c:2149-2157 `bad:` frees reg/irq/dmat/lock/sc — ptb_pages,
   silent_page, sc->mpu never released.

## Fix

Track that emu_init succeeded and unwind via emu_uninit() in `bad:`
(see fix.diff). emu_uninit() is safe to call in this window: it writes
quiescent values to the card (already resources-mapped), frees both DMA
pages, and only calls mpu401_uninit if sc->mpu != NULL (emu10k1.c:2038).

## Reproduce

Hardware-gated: QEMU does not emulate emu10k1 (probe evidence in
env.txt / run.log: no 1102:0002/0004/0008 PCI device, `kldload snd_emu10k1`
fails). Source-level certainty only.