{
  "finding_id": "DF-4285",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "attach-time kernel panic (KKASSERT in lockuninit on held lock) when MPU_INIT fails; permanent small heap leak of m->synth on all init-error and destroy paths",
  "confidence": "certain",
  "verdict": "midi_init() error paths are defective with certainty at source level: err2 (reached with m->lock and m->qlock held after MPU_INIT failure) calls lockuninit() on both locks, which KKASSERTs they are unheld (kern_lock.c:1330-1335) -> panic; and m->synth (allocated at midi.c:311) is never freed on err1/err2 nor in midi_destroy() -> leak. Not runtime-verifiable on this guest: the error path requires an MPU driver attach failure, and the only in-tree midi_init caller is snd_emu401/emu10kx hardware which QEMU cannot emulate.",
  "exploit_chain": "",
  "evidence": "VERDICT.md proof chain: midi.c:325-326 (locks acquired) vs midi.c:354-355,371-373 (err2 lockuninit with locks held) vs kern_lock.c:1325-1336 (KKASSERT); grep shows no kfree(m->synth) anywhere in sys/",
  "kernel_refs": [
    "sys/dev/sound/midi/midi.c:311",
    "sys/dev/sound/midi/midi.c:325-326",
    "sys/dev/sound/midi/midi.c:354-355",
    "sys/dev/sound/midi/midi.c:371-380",
    "sys/kern/kern_lock.c:1325-1336"
  ],
  "poc_changes": "no seed; no runnable PoC possible (hardware-gated error path)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Classified inconclusive per house style for source-certain but hardware-gated findings (cf. DF-0281). The MIDIQ_BUF-NULL check at midi.c:343-345 is unreachable in practice (M_WAITOK kmalloc), leaving MPU_INIT failure as the realistic err2 trigger.",
  "recommended_fix": "release both locks before lockuninit on err2 and kfree(m->synth) on err1 (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable: the failing MPU_INIT attach path cannot be staged on this guest (no emu10kx hardware). fix.diff is a minimal, self-evident error-path correction.",
  "fix_evidence": "source-level: fix.diff vs midi.c:371-380"
}