{
  "finding_id": "DF-4095",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "DF-3867-family race: emu_intr2() (emu10k1.c:1196-1203) tests-and-calls sc->mpu_intr with sc->mpu as argument with NO lock, while the teardown that clears sc->mpu_intr (emu_muninit :1175-1185, under sc->lock) and kfrees sc->mpu (mpu401_uninit -> kfree, mpu401.c:203) runs at detach. emu_intr2 is fired asynchronously by the mpu401_timeout callout (mpu401.c:108-109), so a CPU between the NULL-check and the indirect call can end up in mpu401_intr(freed m) \u2014 heap UAF read/write of struct mpu401. The in-IRQ call site (emu10k1.c:1258-1263) takes sc->lock and is safe; only the callout path is racy. Window is one callout tick and needs real Creative hardware with active MIDI TX during detach, so it is proven-likely at source level but untriggerable on the QEMU guest (no emu10k1 device).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full interleaving diagram + refs); run.log (guest: no 0x1102 PCI device, kldload fails); fix.diff (locks emu_intr2 \u2014 mirrors the locking already used by the safe in-IRQ call site, no new lock order)",
  "kernel_refs": [
    "sys/dev/sound/pci/emu10k1.c:1196-1203",
    "sys/dev/sound/pci/emu10k1.c:1175-1185",
    "sys/dev/sound/pci/emu10k1.c:1214",
    "sys/dev/sound/pci/emu10k1.c:2038-2039",
    "sys/dev/sound/midi/mpu401.c:108-109",
    "sys/dev/sound/midi/mpu401.c:188",
    "sys/dev/sound/midi/mpu401.c:203"
  ],
  "poc_changes": "No PoC seed existed; wrote probe.sh for the guest-side hardware-absence check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l | grep 1102; ls /dev/snd*; kldload snd_emu10k1",
  "code_hash": "",
  "notes": "Companion hazard inside mpu401.c itself (mpu401_timeout reading m->si from freed m) noted in README \u2014 that one belongs to mpu401.c, pass-1 clean; this finding is the emu10k1.c lockless call site only.",
  "recommended_fix": "Wrap emu_intr2()s check+call in snd_mtxlock/sc->lock, matching the already-locked in-IRQ call site.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git-apply-verified; race validation needs physical emu10k1 + MIDI TX + detach, unavailable on the guest.",
  "fix_evidence": "fix.diff (unified, git apply --check OK)"
}