{
 "finding_id": "DF-4440",
 "poc_id": "DF-4440",
 "status": "untested",
 "reproduced": 0,
 "impact": "Deterministic NULL-deref panic (later UAF) via fd held across driver detach/kldunload; root-triggered self-DoS",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "open/close/ioctl validate the softc; read/write/kqfilter do not, and detach never drains open fds. NULL-guard + EBUSY fix in finding markdown.",
 "kernel_refs": [
  "sys/dev/smbus/atmel_mxt/atmel_mxt.c:653",
  "sys/dev/smbus/atmel_mxt/atmel_mxt.c:750",
  "sys/dev/smbus/atmel_mxt/atmel_mxt.c:812",
  "sys/dev/smbus/atmel_mxt/atmel_mxt.c:578"
 ],
 "verdict": "not_run: no atmel i2c controller/device on guest; node is 0600 root:wheel so no unpriv surface",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: no atmel i2c device on guest",
 "fix_evidence": "fix in finding markdown"
}