{
  "finding_id": "DF-4419",
  "poc_id": "DF-4419",
  "status": "untested",
  "reproduced": 0,
  "impact": "UAF write into freed M_DEVBUF block via msp_wake_thread racing msp_detach during kldunload; heap corruption ceiling on dedicated allocation, realistically panic",
  "confidence": "certain",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "Hardware-gated: requires bt848/MSP34xx card (none on QEMU guest) plus privileged kldunload as the free-side trigger. Source-trace proof in finding; pack seeded with minimal untested verdict.",
  "kernel_refs": [
    "sys/dev/video/bktr/msp34xx.c:1213",
    "sys/dev/video/bktr/msp34xx.c:1222",
    "sys/dev/video/bktr/msp34xx.c:1225",
    "sys/dev/video/bktr/msp34xx.c:1232",
    "sys/dev/video/bktr/msp34xx.c:1236",
    "sys/dev/video/bktr/msp34xx.c:1237",
    "sys/dev/video/bktr/msp34xx.c:1239",
    "sys/dev/video/bktr/msp34xx.c:1240"
  ],
  "verdict": "not_run: no bt848 hardware on guest; source-verified UAF window (driver admits XXX mutex lock required, not mp-safe)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no bt848 hardware",
  "fix_evidence": "lockmgr serialization diff in finding markdown (msp_lock around detach handshake/kfree + wake paths with rmmod/kthread bail)"
}