{
 "finding_id": "DF-4512",
 "poc_id": "DF-4512",
 "status": "untested",
 "reproduced": 0,
 "impact": "Per-tick UAF write (8-byte host-influenced value into freed softc) + call through unloaded module text after kldunload",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Detach carries explicit TODOs to stop/deregister the timer but never does; cputimer_intr_deregister exists and is never called. Stop+refuse-while-selected+deregister fix.",
 "kernel_refs": [
  "sys/dev/virtual/hyperv/vmbus/vmbus.c:280",
  "sys/dev/virtual/hyperv/vmbus/vmbus.c:292",
  "sys/dev/virtual/hyperv/vmbus/vmbus.c:297",
  "sys/dev/virtual/hyperv/vmbus/vmbus.c:356"
 ],
 "verdict": "not_run: requires Hyper-V SynIC/SynTimer host (QEMU has none); root-gated kldunload of the live clock source",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: Hyper-V/ath hardware absent from guest",
 "fix_evidence": "fix in finding markdown"
}