{
  "finding_id": "DF-4094",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime-gated: emu_pci_attach() succeeds in emu_init() (which allocates ptb_pages + silent_page DMA at emu10k1.c:1891/1896 and wires mpu401 at :2124), and every later failure (AC97_CREATE :2119, mixer_init :2122, IRQ alloc :2127-2133) jumps to bad: (:2149-2157) which never calls emu_uninit() \u2014 leaking ~6KB coherent DMA + struct mpu401 per failed attach. The QEMU guest has no emu10k1 device (probe: no 0x1102 PCI function, kldload snd_emu10k1 fails), so the path cannot be entered at runtime; classified inconclusive-on-guest rather than not_reproduced.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (4-step source trace with emu10k1.c line refs); run.log (guest probe: pciconf grep 1102 empty, kldload fails); fix.diff (git apply --check clean, adds inited flag + emu_uninit() at bad:)",
  "kernel_refs": [
    "sys/dev/sound/pci/emu10k1.c:2114",
    "sys/dev/sound/pci/emu10k1.c:1891-1901",
    "sys/dev/sound/pci/emu10k1.c:2119-2133",
    "sys/dev/sound/pci/emu10k1.c:2149-2157",
    "sys/dev/sound/pci/emu10k1.c:2035-2039"
  ],
  "poc_changes": "No PoC seed existed; wrote probe.sh documenting the guest-side hardware-absence check and ran it.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l | grep 1102; ls /dev/snd*; kldload snd_emu10k1",
  "code_hash": "",
  "notes": "Hardware-gated (Creative EMU10K1/2/3 PCI). DF-3997 family (attach error-path unwinding), leak-only \u2014 no UAF, no info leak. mpu401_uninit is guarded by if(sc->mpu) inside emu_uninit, so the fix is safe in the bad: window.",
  "recommended_fix": "Track emu_init success and call emu_uninit(sc) in the bad: path before releasing resources.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git-apply-verified against the read-only sys/ tree; cannot be built+validated on the guest because no emu10k1 device exists to attach (and thus fail late).",
  "fix_evidence": "fix.diff (unified, applies clean: git apply --check OK)"
}