{
  "finding_id": "DF-4095",
  "manifest_version": 1,
  "file": "sys/dev/sound/pci/emu10k1.c",
  "verdict": "inconclusive (hardware-gated; source-level likely — race window proven, never triggered)",
  "impact": "kernel heap use-after-free (struct mpu401) during detach with MIDI TX active; panic class",
  "reproduce": {
    "build": "n/a",
    "run": "sh probe.sh  (guest: no emu10k1 device — race not exercisable)",
    "expected": "On real hardware: start MIDI TX, detach device (devctl detach / kldunload path) racing the mpu401_timeout callout -> emu_intr2 calls (sc->mpu_intr)(sc->mpu) with mpu_intr cleared and m freed -> mpu401_intr() on freed struct mpu401."
  },
  "kernel_refs": [
    "sys/dev/sound/pci/emu10k1.c:1196-1203",
    "sys/dev/sound/pci/emu10k1.c:1175-1185",
    "sys/dev/sound/pci/emu10k1.c:1214",
    "sys/dev/sound/pci/emu10k1.c:2038-2039",
    "sys/dev/sound/midi/mpu401.c:108-109",
    "sys/dev/sound/midi/mpu401.c:188",
    "sys/dev/sound/midi/mpu401.c:203"
  ],
  "artifacts": ["README.md", "VERDICT.md", "probe.sh", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}