{
 "finding_id": "DF-4294",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "Kernel heap over-read (match/no-match oracle; page-fault panic at arena boundary). Root-only ngctl + LMC1504 hardware.",
 "verdict": "source-verified; hardware-gated (LMC1504 PCI absent on audit guest; ng control socket root-only)",
 "exploit_chain": [],
 "evidence": "source-only; full path:line trace in pass-2 result block",
 "kernel_refs": [
  "sys/dev/misc/musycc/musycc.c:1013",
  "sys/netgraph/socket/ng_socket.c:247"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4294/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "memchr-NUL validation in musycc_rcvmsg + zero the sentinel byte in the ng socket path",
 "fix_evidence": "source-only"
}