# DF-4538 VERDICT — untested (hardware-gated), analysis certain

## Source chain
1. `snd_setup_intr(dev, sc->irq, 0, cs4281_intr, sc, &sc->ih)` at
   **cs4281.c:812** installs the ISR; the IRQ resource was allocated
   `RF_SHAREABLE` (**cs4281.c:805-806**).
2. `cs4281_intr` (**cs4281.c:512-533**) immediately reads
   `cs4281_rd(sc, CS4281PCI_HISR)` (**cs4281.c:517**) — i.e. a bus_space
   read through `sc->st/sc->sh`, the BA0 mapping — before deciding
   whether the interrupt is ours (there is no early filter/ITHREAD
   filter separation here).
3. `cs4281_pci_detach` (**cs4281.c:878-901**) first calls
   `pcm_unregister` (**cs4281.c:884**) — which stops channels/mixer but
   does **not** unregister the ISR — then releases the BA0 register
   resource (**cs4281.c:893**) and BA1 memory (**cs4281.c:894**), and
   only then runs `bus_teardown_intr` (**cs4281.c:895**).
4. In the window between (3)'s releases and the teardown, any interrupt
   on the (shared) line dispatches `cs4281_intr` into reads of released
   rman-backed mappings → use-after-release; typical outcome panic.
5. The `bad:` attach-unwind has the same inverted order
   (**cs4281.c:867-870**: `bus_teardown_intr` after the two
   `bus_release_resource` calls), though reaching it additionally
   requires an attach failure.
6. Correct ordering exists in the sibling es137x driver
   (**es137x.c:1917-1919**: teardown_intr, release IRQ, release regs).

## Why untested
Requires a real CS4281 PCI function to exist (so attach succeeded and
detach can run) plus root (`kldunload snd_cs4281`) plus an interrupt
arrival inside the release window. The audit guest has no vendor-1013
function (env.txt, run.log) — the detach path cannot execute here at
all. Static chain verified line-by-line; classification **untested**,
confidence **certain**, no unprivileged impact (root-gated) → Low.

## Fix validation
`fix.diff` reorders detach to teardown_intr → IRQ release → BA0/BA1
release. `git apply --check` clean. Not observable on this guest (no
CS4281 hardware) → fix_status not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.