# DF-4539 VERDICT — untested (hardware-gated), analysis certain

## Source chain
1. `mixer_init()` return ignored: **cs4281.c:845**.
2. `pcm_addchan()` returns ignored: **cs4281.c:850-851**.
   `pcm_addchan` fails when `chn_init` fails (sound.c:1125-1141);
   `cs4281chan_init` fails when `sndbuf_alloc` fails
   (**cs4281.c:326-328**) and returns BEFORE `ch->parent = sc;
   ch->channel = c; ch->dma_chan = ...` (**cs4281.c:329-337**), so the
   embedded channel structs keep `parent == NULL` from the M_ZERO'd
   softc (cs4281.c:765).
3. Despite both failures the attach path continues to
   `pcm_setstatus` (**cs4281.c:856**) and returns 0.
4. On a later suspend/resume:
   * `cs4281_pci_resume` (**cs4281.c:941-949**) calls
     `cs4281chan_setspeed(NULL, &sc->rch, sc->rch.spd)` →
     `adcdac_go(ch, 0)` (**cs4281.c:474-479**) → `cs4281_rd(sc, ...)`
     (**cs4281.c:146-150**) with `sc = ch->parent == NULL` → NULL deref
     (reads `sc->st` at offset of bus_space tag) → panic.
   * `mixer_reinit(dev)` at **cs4281.c:935** → **mixer.c:828-829**
     `pdev = mixer_get_devt(dev); m = pdev->si_drv1;` where
     `mixer_get_devt` (**mixer.c:118-124**) returns `snddev->mixer_dev`
     == NULL when the ignored `mixer_init` failed → NULL deref panic.

## Preconditions
* `sndbuf_alloc` failure (busdma/DMA memory pressure at attach) for the
  addchan leg, or any `mixer_init` failure for the mixer leg;
* then ACPI suspend+resume (root).

No unprivileged path exists; both legs need root to trigger. Low.

## Why untested
The audit guest has no vendor-1013 CS4281 function (env.txt) — the
attach, hence both failure legs, cannot occur; suspend of a
nonexistent device is equally unreachable. Analysis is line-verified;
classification **untested**, confidence certain.

## Fix validation
`fix.diff` guards `cs4281_pci_resume` to fail cleanly when either
channel never initialized (`sc->rch.parent == NULL || sc->pch.parent ==
NULL` → ENXIO before `mixer_reinit`/channel restore). The attach-side
half (check `mixer_init`/`pcm_addchan`, unwind via `pcm_unregister`)
ships in the DF-4537 fix; both apply clean (`git apply --check`).
Not observable on this guest → fix_status not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.