{
  "finding_id": "DF-4293",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "mixer_reinit (mixer.c:828-830), mixer_hwvol_init (:881-882), mixer_hwvol_mute (:915-916) and mixer_hwvol_step (:955-956) dereference mixer_get_devt(dev)->si_drv1 with no NULL guards, although snddev->mixer_dev is NULL whenever mixer_init failed (mixer.c:709-711 returns before make_dev when the drivers MIXER_INIT fails) or after mixer_uninit (:814), and mixer_uninit itself demonstrates the required guard (:776). Driver resume/reinit handlers (als4000.c:909, cmi.c:1075, solo.c:965, vibes.c:673, cs4281.c:935, hdaa.c:6576) then NULL-deref -> Fatal trap 12 panic (CWE-476). Low severity: the trigger needs a privileged/hardware lifecycle event on a mixer-less pcm device (the DF-4156/4193 driver-misbehavior family in the pcm core), not the 0666 device. NOT triggerable on this guest (single healthy ES1370 mixer; no suspend/resume) -> inconclusive, trace-certain. The 0666 ioctl surface itself WAS live-tested as uid 1001 (QEMU -device ES1370 + snd_es137x): two hostile batteries (all 256 mixer device-bytes read+write+dsprouting with 8 hostile payloads, SNDCTL_DSP_*/MIXERINFO/AUDIOINFO/SYSINFO with hostile and negative indices, ~1.06M concurrent mixer ops incl. clone-alias churn) produced zero panics and zero unexpected errnos (ok=66 enxio=247 einval=2571 other=0; round 2 clean) \u2014 run.log/run.2.log. Pass-2 negative space (dispatch bounds, name tables, volume packing, devinfo lifetime, count refresh, sndstat) documented killed in VERDICT.md.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (trace + full negative-space section); run.log/run.2.log (live hostile-ioctl batteries, uid 1001, guest survived); env.txt (ES1370 pcm0, 0666 /dev/mixer0); fix.diff (4x NULL guard)",
  "kernel_refs": [
    "sys/dev/sound/pcm/mixer.c:828",
    "sys/dev/sound/pcm/mixer.c:881",
    "sys/dev/sound/pcm/mixer.c:915",
    "sys/dev/sound/pcm/mixer.c:955",
    "sys/dev/sound/pcm/mixer.c:117",
    "sys/dev/sound/pcm/mixer.c:776",
    "sys/dev/sound/pci/hda/hdaa.c:6576"
  ],
  "poc_changes": "mixbattery.c: fixed oss_sysinfo field nmixers->nummixers for the guests soundcard.h; everything else compiled as written",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 95,
  "guest_dirty": 1,
  "build_cmd": "cc -O -pthread -o /tmp/mixbattery /tmp/mixbattery.c && cc -O -pthread -o /tmp/mixbattery2 /tmp/mixbattery2.c",
  "run_cmd": "/tmp/mixbattery && /tmp/mixbattery2 (as uid 1001)",
  "notes": "guest_dirty=1: snd_es137x+sound kldloaded and ES1370 launcher used (reverted by orchestrator snapshot flow; no kernel state changes persist). Low finding -> per contract no fix-build validation required; fix.diff authored from trace.",
  "recommended_fix": "Add pdev==NULL || pdev->si_drv1==NULL guards (ENXIO/return) to mixer_reinit and the three mixer_hwvol_* entry points, mirroring mixer_uninit:776",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Low severity, defect not triggerable on this guest (needs mixer-less pcm device + resume event); per contract fix-build validation is reserved for reproduced memory-corruption findings. fix.diff (4 NULL guards mirroring mixer_uninit:776) authored from trace.",
  "fix_evidence": "findings/poc/DF-4293/fix.diff (not applied to sys/; authored post-verification from line-accurate trace)"
}