# DF-4457 — cmi_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc (UAF on open/ioctl)

7th instance of the DF-4156/4193/4299/4334/4344/4421 sound-driver family,
in `sys/dev/sound/pci/cmi.c`.

## Reproduce (on hardware with a CMI8738-class card)

1. `sh trigger.hw.sh` — preconditions and expected dangling-cdev state.
2. Success criterion: after a failed snd_cmi attach that got past
   `mixer_init()`, `ls -l /dev/mixerN` still shows the 0666 cdev and any
   unprivileged `open`+`ioctl(MIXER_WRITE(...))` dispatches through the
   freed softc (garbage bus_space reads/writes / panic under INVARIANTS).

## On the audit QEMU guest

`sh run.sh` — proves the gate: no CMedia/audio PCI device, snd_cmi.ko
cannot load (midi dependency mismatch). Runtime reproduction is
impossible on this guest; the defect is proven by source trace
(VERDICT.md).

## Build (fix compile-validation)

`sh build.sh` (inside guest, with the fixed cmi.c staged at
/root/cmi.fixed.c) — baseline and fix both build `-Werror` clean.

## Files

* `VERDICT.md` — full narrative, root-cause table, negative results
* `trigger.hw.sh` — real-hardware trigger
* `run.sh` + `run.log` / `guest_check.log` — guest hardware-gate proof
* `build.sh` + `build.log` — pristine & patched module builds
* `fix.diff` — git-apply-able unified diff (validated: applies clean,
  compiles -Werror clean as a module on the guest)
* `env.txt` — guest environment