{
 "finding_id": "DF-4480",
 "poc_id": "DF-4480",
 "status": "untested",
 "reproduced": 0,
 "impact": "Latent intra-object OOB read (mix[25] lands on name[]) + bogus RECSEL write + nonexistent 1<<25 return bit; no userspace disclosure",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Same pattern as DF-1321/1330 where it WAS reachable. One-line guard (FreeBSD carries it). Fix in finding markdown.",
 "kernel_refs": [
  "sys/dev/sound/pcm/ac97.c:1069",
  "sys/dev/sound/pcm/ac97.c:1072",
  "sys/dev/sound/pcm/ac97.c:423"
 ],
 "verdict": "not_run: latent - mixer core always substitutes a valid source when recdevs!=0 (always true today); guest codec unaffected",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable",
 "fix_evidence": "fix in finding markdown"
}