{
 "finding_id": "DF-4193",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "es_pci_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed codec/es (UAF on open/ioctl). Attach-failure precondition only (IRQ/dma-tag/pcm_register failure after mixer_init) - not user-triggerable on demand. Same family as DF-4156 (maestro).",
 "verdict": "source-verified; attach-failure-gated",
 "exploit_chain": [],
 "evidence": "es137x.c:1816/1829 mixer_init make_dev vs bad: 1879-1894 frees codec/es without mixer teardown; mixer.c:730-733",
 "kernel_refs": [
  "sys/dev/sound/pci/es137x.c:1816",
  "sys/dev/sound/pci/es137x.c:1879"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4193/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "move mixer_init after pcm_register (as most pcm drivers do) or mixer_uninit on the bad: path before freeing codec/es",
 "fix_evidence": "source-only"
}