{
  "finding_id": "DF-4096",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardening (CWE-476), unreachable today: emupchan_init (emu10k1.c:823-828) feeds unchecked emu_valloc() results into emu_vinit(), which writes m->start/m->channel through the pointer (:579-598) \u2014 NULL write if voice exhaustion ever occurs. It cannot occur: pcm_addchan is the only CHANNEL_INIT invoker, pcm_register caps play channels at nchans = audigy?8:4 (:2087,:2139-2141), 2 voices per channel = 16 of the 64-voice pool; vchans use their own class (pcm/vchan.c:240). Filed Info so the latent NULL write is fenced off before anyone raises the channel count.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (reachability proof incl. framework bounds); run.log (no emu10k1 device on guest); fix.diff (NULL check returning NULL to the pcm cores existing failure path)",
  "kernel_refs": [
    "sys/dev/sound/pci/emu10k1.c:823-828",
    "sys/dev/sound/pci/emu10k1.c:552-565",
    "sys/dev/sound/pci/emu10k1.c:574-580",
    "sys/dev/sound/pci/emu10k1.c:2087",
    "sys/dev/sound/pci/emu10k1.c:2139-2141"
  ],
  "poc_changes": "No PoC seed; wrote probe.sh for the guest-side hardware-absence check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l | grep 1102; ls /dev/snd*; kldload snd_emu10k1",
  "code_hash": "",
  "notes": "DF-3866-family shape (unchecked allocation-index/lifetime feeding a deref) but with the index bounded by framework invariants, not attacker input.",
  "recommended_fix": "Check emu_valloc() results in emupchan_init and return NULL on exhaustion.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git-apply-verified; branch is unreachable even on hardware, so no runtime validation is possible by construction.",
  "fix_evidence": "fix.diff (unified, git apply --check OK)"
}