{
  "finding_id": "DF-4538",
  "title": "cs4281_pci_detach() releases the BA0/BA1 register mappings before bus_teardown_intr - live ISR reads released mappings (shared-IRQ use-after-release window)",
  "verdict": "untested",
  "impact": "none",
  "reproduce": {
    "build": "./build.sh  (guest cc: cc -O -Wall -o /root/cs4281_probe /root/cs4281_probe.c)",
    "run": "./run.sh  (/root/cs4281_probe; pciconf -l | grep -i 1013)",
    "expected": "On CS4281 hardware: kldunload snd_cs4281 racing an interrupt panics in cs4281_rd via cs4281_intr. On this guest: detach path unreachable (no vendor-1013 function)"
  },
  "kernel_refs": ["sys/dev/sound/pci/cs4281.c:893","sys/dev/sound/pci/cs4281.c:895","sys/dev/sound/pci/cs4281.c:517","sys/dev/sound/pci/cs4281.c:812","sys/dev/sound/pci/cs4281.c:867"],
  "artifacts": ["README.md","VERDICT.md","cs4281_probe.c","build.sh","run.sh","build.log","run.log","env.txt","wedge_episode.txt","fix.diff","manifest.json","verdict.json"]
}