# DF-4157 VERDICT

**status: untested (hardware-gated) | impact ceiling: kernel OOB write (corruption primitive)**

## Reproduced?

No. The audit guest has no Maestro PCI audio function (`pciconf -lv`),
no /dev/dsp (run.log) — the driver never attaches, so the record path
cannot be exercised. Source-level certainty for the defect:

- `maestro.c:1090-1092` (`aggch_feed_adc_stereo`) and `maestro.c:1129-1131`
  (`aggch_feed_adc_mono`): `cur` = 16-bit `APUREG_CURPTR` register value
  minus the 0xffff-masked base offset — **no clamp** against the ring size
  before it becomes the sample count of `interleave()`/`mixdown()`
  (`maestro.c:1073-1081`, `1115-1121`), which write 2 int16 / 1 int16 per
  iteration directly into the `3*ess->bufsz` `stat` busdma buffer
  (`maestro.c:1829`).
- Underflow path: register < base offset → `cur ≈ 2^32 - k` →
  `cur > last` branch → `interleave(..., cur - last)` with n ≈ 4e9 →
  writes march off the end of the DMA allocation into adjacent kernel
  memory with recorded-audio contents.
- Software consistency (why it needs desync): LOOPLEN programmed as
  `ch->buflen >> ch->stereo` (`maestro.c:997,1003`) equals the ring sample
  capacity, so a *live, coherent* APU wraps in-range. The driver itself
  creates incoherent windows:
  * `agg_intr()` reads `ess->curpwr` locklessly (`maestro.c:1653`) and
    dispatches `chn_intr(rch.channel)` → `PCMTRIG_EMLDMARD` → feed, while
    `agg_suspend()`/`agg_power(D3)` power the part down under `agg_lock`
    (`maestro.c:821-832`, `1989-1992`) — post-D3 register reads are
    garbage.
  * `aggch_stop_adc()` clears `active` and sets APUs INACTIVE under the
    lock (`maestro.c:1049-1053`) racing an interrupt already past its
    `ess->active & m` test (`maestro.c:1664-1676`).
- `wp_rdapu()` has no error propagation either — on timeout it prints and
  still returns raw `PORT_DSP_DATA` (`maestro.c:451-458`).

## Exploit chain (if hardware present)

open /dev/dspN O_RDONLY (0666 via devfs clone) → set AFMT_S16_LE/stereo →
read() loop keeps the ADC feeding → concurrently force the power-state
race (suspend/resume storm, or stop/start churn of the record channel) →
when a desynced CURPTR lands, `interleave()` smashes adjacent kernel heap
with recorded-audio (attacker-chosen int16 pairs) at attacker-influenced
length → groom victim objects adjacent to the stat buffer → uid=0.
Not demonstrable on this guest; recorded as ceiling.

## Fix validation

Not possible on this guest (no hardware). `fix.diff` clamps the
register-derived index in both feed functions; `git apply --check` passes.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.