{
  "finding_id": "DF-4096",
  "manifest_version": 1,
  "file": "sys/dev/sound/pci/emu10k1.c",
  "verdict": "inconclusive (hardware-gated + currently unreachable; source-level certain of the missing check)",
  "impact": "none today — latent NULL-pointer write (CWE-476 hardening)",
  "reproduce": {
    "build": "n/a",
    "run": "sh probe.sh  (guest: no emu10k1 device)",
    "expected": "Unreachable: needs >32 registered play channels; framework caps at 8 (pcm_register nchans = audigy?8:4, 2 voices/channel, 64-voice pool). With that invariant broken, emu_vinit would write m->start through NULL at emu10k1.c:579."
  },
  "kernel_refs": [
    "sys/dev/sound/pci/emu10k1.c:823-828",
    "sys/dev/sound/pci/emu10k1.c:552-565",
    "sys/dev/sound/pci/emu10k1.c:574-580",
    "sys/dev/sound/pci/emu10k1.c:2087",
    "sys/dev/sound/pci/emu10k1.c:2139-2141"
  ],
  "artifacts": ["README.md", "VERDICT.md", "probe.sh", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}