{
  "finding_id": "DF-4192",
  "title": "pcm chn_trigger() trigger-flag/busy-list race: unprivileged kernel panic and unrecoverable system hang via SNDCTL_DSP_SETTRIGGER",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "guest: cc -O2 -pthread -o /tmp/trighammer /tmp/trighammer.c (any user; prereq: QEMU -device ES1370 + kldload snd_es137x, /dev/dsp 0666)",
    "run": "/tmp/trighammer 30   (unprivileged; 4 threads race SNDCTL_DSP_SETTRIGGER START/0 on one shared dsp fd + SETFRAGMENT/SPEED churn + read/write)",
    "expected": "kernel panic: 'Fatal trap 12 ... fault virtual address = 0x138' at chn_trigger+0x263 (movq 0x138(%rdx),%rax, rdx==NULL), process = the unprivileged PoC; intermittently instead a silent full-system hang with a CPU spinning at chn_trigger+0x26a (cmpq %rbx,%rax) holding the channel lock while all dsp/mixer clients block in lockmgr_exclusive"
  },
  "kernel_refs": [
    "sys/dev/sound/pcm/channel.c:2198",
    "sys/dev/sound/pcm/channel.c:2201",
    "sys/dev/sound/pcm/channel.c:2215",
    "sys/dev/sound/pcm/channel.c:2218",
    "sys/dev/sound/pcm/channel.h:190",
    "sys/dev/sound/pcm/channel.h:193",
    "sys/dev/sound/pcm/channel.h:213",
    "sys/dev/sound/pcm/dsp.c:1589",
    "sys/dev/sound/pci/es137x.c:755"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trighammer.c", "es_batt.c", "build.sh",
    "run.sh", "run.log", "panic.txt", "ddb_ps_stuck_threads.txt",
    "ddb_blocked_stacks.txt", "env.txt", "fix.diff", "fix_build.log",
    "manifest.json", "verdict.json"
  ]
}