{
  "finding_id": "DF-4227",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "summary": "cyapa_detach (cyapa.c:545-571) does not refuse detach while fds are open, does not wake readers blocked in lksleep (cyapa.c:749), and cyaparead/cyapawrite/cyapakqfilter (cyapa.c:616/789/1069) lack the NULL softc check that open/close/ioctl have. After kldunload (subr_bus.c:1164 clears dc->devices[unit]) a read()/write() on the still-open fd gets sc=NULL and calls lockmgr(&sc->lk) -> NULL-deref panic; dispatch itself goes through module ops memory freed by the unload. Source-certain; requires the /dev/cyapa* node (0600 root:wheel) on real cypress-trackpad hardware.",
  "reproduce": {
    "build": "cc -O2 -Wall -o trigger_detach_uaf trigger_detach_uaf.c",
    "run": "shell1: ./trigger_detach_uaf & ; shell2: kldunload cyapa.ko",
    "expected": "reader thread panics in lockmgr on NULL+offset (or dispatch through freed module ops)"
  },
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:545",
    "sys/dev/smbus/cyapa/cyapa.c:567",
    "sys/dev/smbus/cyapa/cyapa.c:616",
    "sys/dev/smbus/cyapa/cyapa.c:626",
    "sys/dev/smbus/cyapa/cyapa.c:749",
    "sys/dev/smbus/cyapa/cyapa.c:789",
    "sys/dev/smbus/cyapa/cyapa.c:1069",
    "sys/kern/subr_bus.c:1164",
    "sys/kern/subr_bus.c:932",
    "sys/vfs/devfs/devfs_core.c:1546"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_detach_uaf.c", "build.sh", "run.sh",
    "run.log", "run.2.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}