{
  "finding_id": "DF-4537",
  "title": "cs4281: attach-failure path after mixer_init() leaves a live 0666 /dev/mixerN over freed codec/softc - mixer-UAF family (10th instance)",
  "verdict": "untested",
  "impact": "none",
  "reproduce": {
    "build": "./build.sh  (guest cc: cc -O -Wall -o /root/cs4281_probe /root/cs4281_probe.c)",
    "run": "./run.sh  (/root/cs4281_probe; pciconf -l | grep -i 1013)",
    "expected": "On trigger hardware with failed pcm_register: 'UNPRIV mixer ioctl OK' on the dangling /dev/mixerN. On this guest: 'no /dev/mixer* nodes exist' + 'no vendor-1013 PCI function' (trigger environment absent)"
  },
  "kernel_refs": ["sys/dev/sound/pci/cs4281.c:845","sys/dev/sound/pci/cs4281.c:847","sys/dev/sound/pci/cs4281.c:862","sys/dev/sound/pci/cs4281.c:873","sys/dev/sound/pcm/mixer.c:730","sys/dev/sound/pcm/ac97.c:852","sys/dev/sound/pcm/sound.c:1021","sys/dev/sound/pcm/sound.c:1205"],
  "artifacts": ["README.md","VERDICT.md","cs4281_probe.c","build.sh","run.sh","build.log","run.log","env.txt","wedge_episode.txt","fix.diff","manifest.json","verdict.json"]
}