{
 "finding_id": "DF-4530",
 "poc_id": "DF-4530",
 "status": "untested",
 "reproduced": 0,
 "impact": "Per-fd dsp wedge: fake-running channel blocks writes/poll until close; no memory-safety impact (busy-list membership stays paired)",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "trigger state and busy-list membership committed before the fallible chn_notify and never rolled back; the masked-retry early return then reports success while the parent hardware never started. Deterministic triggering needs an audio driver whose CHANNEL_TRIGGER fails on demand - no guest codec provides that. Busy-list membership paired throughout => walkers never see stale/double-linked entries.",
 "kernel_refs": [
  "sys/dev/sound/pcm/vchan.c:150",
  "sys/dev/sound/pcm/vchan.c:160",
  "sys/dev/sound/pcm/vchan.c:165",
  "sys/dev/sound/pcm/vchan.c:171",
  "sys/dev/sound/pcm/vchan.c:144"
 ],
 "verdict": "not_run: Low state-machine DoS, no deterministic unpriv trigger on guest",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable",
 "fix_evidence": "rollback-on-notify-failure diff in finding markdown"
}