{
  "finding_id": "DF-4421",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain, kernel runtime hardware-gated: ich_pci_attach() calls mixer_init() (ich.c:1031, publishing a 0666 /dev/mixerN whose si_drv1 devinfo chain reaches the AC97 codec, mixer.c:726-728) before five failure paths that all goto bad (bus_dma_tag_create x2 ich.c:1045/1053, bus_dmamem_alloc ich.c:1060, bus_dmamap_load ich.c:1065, pcm_register ich.c:1069 which fails EINVAL via pcm_veto_load or ENODEV via PCMMAXUNIT, sound.c:1021-1033); the bad: unwind then ac97_destroy()s the codec (ich.c:1096-1097, kobj_delete+kfree per ac97.c:852-859) and kfrees the softc (ich.c:1118) while the mixer cdev stays registered -- any later mixer open/ioctl dispatches through freed memory. Identical construct to the verified family members (DF-4156 maestro, DF-4193 es137x, DF-4299 emu10kx-pcm, DF-4334 via8233, DF-4344 atiixp); this is the 6th instance, with the widest window in the family (five post-mixer gotos vs atiixps one) and mixer_inits return ignored entirely. Not runtime-reproducible on the audit guest: QEMU i440FX has no AC97 controller (no class 0401 PCI function; only 8086:1237/7000/7010/7113 present), so ich_pci_probe never matches and ich_pci_attach never executes -- snd_ich.ko itself loads cleanly (kldstat), proving deployment (guest_check.log). Ceiling on real hardware: local unprivileged UAF read/write through a 0666 cdev, trigger requires an attach-time failure (memory pressure / 33rd sound unit / broken feeder boot) -- hence Low, matching family precedent.",
  "exploit_chain": "",
  "evidence": "VERDICT.md root-cause table (ich.c:1031-1118, mixer.c:687-737, sound.c:1016-1040); guest_check.log (no 0401 PCI device, snd_ich loads, 0 pcm devices); build.log (fix-compiled snd_ich.ko, -Werror clean); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/sound/pci/ich.c:1031",
    "sys/dev/sound/pci/ich.c:1069",
    "sys/dev/sound/pci/ich.c:1096",
    "sys/dev/sound/pci/ich.c:1118",
    "sys/dev/sound/pcm/mixer.c:726",
    "sys/dev/sound/pcm/sound.c:1021"
  ],
  "poc_changes": "no seed; family trigger shape (DF-4334/DF-4344) adapted; hardware absent so guest probe substituted",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/dev/sound/driver/ich && make obj && make   (patched ich.c, guest cc 8.3)",
  "run_cmd": "kldload snd_ich; pciconf -l | grep class=0x0401; devinfo -v | grep -c pcm   (expect: loads, NO pcm device attaches)",
  "code_hash": "",
  "notes": "Guest source restored to pristine after fix compile test (md5 2a290625f264317f5ce793fbb381a197 matches tree). snd_ich.ko left loaded (probes nothing) -- not unloaded to avoid the known DF-4116 sndstat unload panic. Pass-2 negative results (killed classes) in VERDICT.md: ch[num] pre-check OOB write unreachable (chnum<=3, sound.c:585), setspeed uint32 overflow killed by RANGE clamp (channel.c:1983), getptr arithmetic in-bounds via filldtbl clamp (ich.c:305-306) + chn_dmaupdate modulo (channel.c:387), ich_setmap single-seg safe (nsegments=1, ich.c:1045-1047), BDLE length fits 16 bits, codec reg mask &0xff within 256B BAR, LVI arithmetic mod-bounded, resume ich_init==-1 dead check (cosmetic, upstream-identical), 1<<(i-1) hint UB self-heals on x86 (root-only), calibrate intrhook detach race boot-only.",
  "recommended_fix": "Move pcm_register() before mixer_init() and check mixer_init()s return (DF-4334 family shape), eliminating all failure paths after the 0666 mixer cdev is published",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (git apply --check OK) reorders pcm_register() ahead of mixer_init() and checks its return; validated to COMPILE cleanly with -Werror on the guest toolchain (cc 8.3, patched snd_ich.ko built and linked, build.log). Behavioral baseline/patched runs are impossible on this guest: ich_pci_attach requires an AC97 controller the guest cannot present, so the failure path never executes at runtime (fix_status not_testable, compile-validated).",
  "fix_evidence": "fix.diff; build.log (full -Werror compile + link, BUILD_RC=0); VERDICT.md Fix validation section citing mixer.c:726-764 (no make_dev failure path) and sound.c:1016-1040 (pcm_register has no mixer dependency)"
}