{
  "verdict": "reproduced / panic / certain",
  "impact": "panic",
  "finding_id": "DF-4116",
  "file": "sys/dev/sound/pcm/sndstat.c",
  "root_cause": "sndstat_buflen=0 static init vs sbuf-only-created-in-open invariant; MOD_UNLOAD acquire makes the PID guard always pass; sbuf_delete on never-initialized static sbuf",
  "reproduce": {
    "build": "none (module present); for fix: cd /usr/src/sys/dev/sound/sound && make",
    "run": "sh trigger.sh   # kldload sound; kldunload sound",
    "expected": "stock: panic 'sbuf_delete called with uninitialized or corrupt sbuf' in sndstat_sysuninit (guest down in ddb); patched: UNLOADED-CLEAN rc=0"
  },
  "kernel_refs": [
    "sys/dev/sound/pcm/sndstat.c:68",
    "sys/dev/sound/pcm/sndstat.c:444",
    "sys/dev/sound/pcm/sndstat.c:453",
    "sys/dev/sound/pcm/sound.c:1433",
    "sys/kern/subr_sbuf.c:100",
    "sys/kern/kern_linker.c:545"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger.sh", "run.sh", "run.log",
    "panic.txt", "panic.2.txt", "build.log", "fix.diff", "env.txt",
    "manifest.json", "verdict.json"
  ]
}