# DF-4096 — emupchan_init passes unchecked emu_valloc() NULL into emu_vinit() (hardening)

File: `sys/dev/sound/pci/emu10k1.c` (pass 2, GLM 5.3)

## What

    snd_mtxlock(sc->lock);                       /* emu10k1.c:823-828 */
    ch->master = emu_valloc(sc);
    ch->slave = emu_valloc(sc);
    snd_mtxunlock(sc->lock);
    r = (emu_vinit(sc, ch->master, ch->slave, sc->bufsz, ch->buffer))
        ? NULL : ch;

`emu_valloc()` (emu10k1.c:552-565) returns NULL when all 64 entries of
`sc->voice[]` are busy. The NULL return is never checked;
`emu_vinit()` (emu10k1.c:568-616) immediately does

    buf = emu_memalloc(sc, sz, &tmp_addr);
    if (buf == NULL) return -1;
    ...
    m->start = emu_memstart(sc, buf) * EMUPAGESIZE;   /* m == NULL => NULL write */

i.e. a write through `m->start` at offset ~0x14 of NULL — kernel page-0
write/panic. Same shape for `s` (slave) at emu10k1.c:600-614.

## Reachability (why Info, not Low)

Every registered play channel consumes exactly 2 voices; the framework
channel-init count is fixed by `pcm_register(dev, sc, sc->nchans, ...)`
with `sc->nchans = audigy ? 8 : 4` (emu10k1.c:2087, 2139-2141), and
`pcm_addchan` is the only invoker of `CHANNEL_INIT` (verified:
`emupchan_class` has no other in-tree users; vchans use their own class in
pcm/vchan.c). Maximum possible consumption is 16 of 64 voices — the
exhaustion branch is unreachable today. It becomes live the day anyone
raises the registered play-channel count above 32 or adds a dynamic
channel-creation path, with no local error marker — hence filed as a
hardening finding (CWE-476).

## Fix

Check both allocations before dereferencing (see fix.diff) — return NULL so
the pcm framework's pcm_chn_create failure path handles it cleanly.

## Reproduce

Hardware-gated + currently unreachable (see VERDICT.md). Guest probe
evidence in run.log (no emu10k1 device on the QEMU guest).