{
  "finding_id": "DF-4421",
  "file": "sys/dev/sound/pci/ich.c",
  "title": "ich_pci_attach mixer_init-before-failure-paths leaves live 0666 /dev/mixerN over freed AC97 codec + softc (UAF on open/ioctl) — DF-4156/4193/4299/4334/4344 family, 6th instance",
  "verdict": "inconclusive (code defect certain; runtime hardware-gated on QEMU guest)",
  "impact": "none (ceiling on real hardware: local UAF read/write via 0666 cdev)",
  "severity": "Low",
  "reproduce": {
    "build": "n/a on this guest — trigger requires ICH/SIS7012/nForce/AMD AC'97 PCI hardware (class 0x0401); guest has none (guest_check.log)",
    "run": "sh trigger.hw.sh on real hardware (attach must fail after mixer_init: memory pressure / PCMMAXUNIT / pcm_veto_load)",
    "expected": "dangling /dev/mixerN after failed attach; open/ioctl → UAF through ac97_destroy'd codec"
  },
  "kernel_refs": [
    "sys/dev/sound/pci/ich.c:1031",
    "sys/dev/sound/pci/ich.c:1045",
    "sys/dev/sound/pci/ich.c:1053",
    "sys/dev/sound/pci/ich.c:1060",
    "sys/dev/sound/pci/ich.c:1065",
    "sys/dev/sound/pci/ich.c:1069",
    "sys/dev/sound/pci/ich.c:1096",
    "sys/dev/sound/pci/ich.c:1118",
    "sys/dev/sound/pcm/mixer.c:726",
    "sys/dev/sound/pcm/mixer.c:728",
    "sys/dev/sound/pcm/sound.c:1021",
    "sys/dev/sound/pcm/ac97.c:852"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "run.sh",
    "trigger.hw.sh",
    "guest_check.log",
    "env.txt",
    "build.log",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}