{
  "finding_id": "DF-4115",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "hdac.c:1934 computes bidirectional-stream tags as 15-(ss-num_iss+num_oss)=15-2*num_oss-j instead of the intended 15-j; proven by source analysis and by the upstream FreeBSD fix (present since 11.2R/12.x, missing from DFs r275101 import). Impact is functional (wrong/colliding/negative HDA stream tags -> misprogrammed SDCTL2/codec registers on BSS-capable controllers), not memory safety. Live trigger is hardware-gated: the only available controller (QEMU ICH6) reports Caps: OSS 4, ISS 4, BSS 0 so the buggy branch never executes; the surrounding user-reachable paths (stream alloc/start/free, hostile SETFRAGMENT, BDL-walk clamps, polling mode) were live-exercised unprivileged with no panic and the clamp chain proven to hold.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (upstream diff + mechanism); dmesg_verbose.txt (hard sndbuf blkcnt<=2 under hostile fragments, hblkcnt>256 request clamped at hdaa.c:2096); caps.txt (runtime BSS 0 - trigger structurally absent); run.log (1310-round battery + 11 hostile frag shapes with real stream starts, guest alive); panic.sndstat.txt (cross-file root-only kldunload panic in sndstat_sysuninit, hdac detaches cleanly - for the orchestrator)",
  "kernel_refs": [
    "sys/dev/sound/pci/hda/hdac.c:1933",
    "sys/dev/sound/pci/hda/hdac.c:1934",
    "sys/dev/sound/pci/hda/hdac.c:2010",
    "sys/dev/sound/pci/hda/hdaa.c:2096",
    "sys/dev/sound/pcm/channel.c:1832"
  ],
  "poc_changes": "No PoC seed existed. Authored three live-test programs (dsp_battery.c, frag_start.c, hblkcnt_max.c); trigger for the finding itself is unreachable on the guest (BSS 0), so the pack instead proves the adjacent user-reachable paths safe and documents the hardware gate.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1260,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/frag_start /tmp/frag_start.c (see build.sh)",
  "run_cmd": "/tmp/frag_start (see run.sh)",
  "code_hash": "eaa4063ae1a23fbc0c5cc11287322999b8bafcd1753c22b63847baca8ec20b46",
  "notes": "Audio guest built per DF-3879 pattern (-audiodev none,id=snd0 -device intel-hda -device hda-duplex) on a temp launcher; vm.sh untouched; guest vm.sh-reset (with-src) after the run. Cross-file observation: root-only kldunload snd_hda after use panics in sndstat_sysuninit (sbuf_delete corrupt) - hdac not implicated; recommend attributing to sys/dev/sound/pcm/sndstat.c.",
  "recommended_fix": "Adopt upstream FreeBSD fix: stream = 15 - (ss - sc->num_iss - sc->num_oss); (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies the proven upstream one-line correction. Kernel-level validation impossible on the only available hardware (BSS 0 - the patched branch never executes, baseline behaviour equally unobservable); the fix is byte-identical to FreeBSD 11.2+ which has shipped it for 8+ years.",
  "fix_evidence": "fix.diff; VERDICT.md section 4; upstream tags 11.1.0 (+) vs 11.2.0 (-) fetched 2026-09-18"
}