# VERDICT — DF-4550

**Status: not_reproduced** (hardware-gated trigger). **Impact: none on this
guest**; on real hardware the class is an unprivileged UAF (family precedent:
DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537, all filed Low).

## Root cause (path:line)

`als_pci_attach` — sys/dev/sound/pci/als4000.c:808-864:

```c
if (mixer_init(dev, &als_mixer_class, sc)) {   // :842  <-- publishes mixer
        device_printf(dev, "failed to initialize mixer\n");
        goto bad_attach;
}

if (pcm_register(dev, sc, 1, 1)) {             // :847  <-- can fail AFTER
        device_printf(dev, "failed to register pcm entries\n");
        goto bad_attach;                       //       mixer is live
}
...
bad_attach:
        als_resource_free(dev, sc);            // :861
        kfree(sc, M_DEVBUF);                   // :862  mixer->devinfo dangles
        return ENXIO;
```

`mixer_init()` (sys/dev/sound/pcm/mixer.c:687-763) creates the snd_mixer with
`m->devinfo = devinfo` (= `sc`) at mixer.c:635, then publishes a
**world-accessible** device node — `make_dev(&mixer_ops, ..., UID_ROOT,
GID_WHEEL, 0666, "mixer%d", unit)` at mixer.c:730-732 with
`pdev->si_drv1 = m`. On `pcm_register()` failure (sound.c:1021-1025
`pcm_veto_load` → EINVAL; :1027-1033 unit > PCMMAXUNIT → ENODEV; or ENOMEM
inside pcm_register), `bad_attach` frees `sc` (als4000.c:862) but never
unregisters the mixer: a failed newbus attach does not run detach, so
`/dev/mixerN` survives with `m->devinfo` pointing into freed M_DEVBUF memory.

Any subsequent open/ioctl (0666 — unprivileged) on that node reaches
`mixer_set` → `MIXER_SET` → `alsmix_set` (als4000.c:574-603), which calls
`mix_getdevinfo(m)` → freed `sc`, then `als_mix_rd/sc, ...` /
`als_mix_wr(sc, ...)` (als4000.c:133-145) dereferencing the stale
`sc->st`/`sc->sh` — UAF reads and RMW writes through freed heap (plus actual
I/O port writes to a bus_space region that `als_resource_free` already
released, als4000.c:741-744). `alsmix_setrecsrc` (als4000.c:605-626) is the
same via SOUND_MIXER_WRITE_RECSRC. Same defect shape as the ten filed family
instances.

## Why not reproduced

The QEMU guest has no Avance Logic ALS4000 PCI device
(`ALS_PCI_ID0 0x40004005`, als4000.h:29 — guest_hw_evidence.txt: pciconf has
no vendor 4005; `kldload snd_als4000` succeeds but the driver never probes,
so neither mixer_init nor pcm_register ever runs). No QEMU device model
exists for this card; constructing the trigger additionally requires the
attach-time pcm_register failure. Confidence `certain` is by code inspection
(the family defect was previously verified in-tree for sibling drivers and
the framework side is identical here).

## Exploration note (guest crash — separate, already-filed finding)

During exploration `kldunload snd_als4000` (which cascades the sound.ko
unload) panicked the guest:

```
panic: sbuf_delete called with uninitialized or corrupt sbuf
sbuf_delete() at sbuf_delete+0x1b
sndstat_sysuninit() at sndstat_sysuninit+0x8c
linker_file_unload() at ...
```

This is the already-filed **DF-4116** (sys/dev/sound/pcm/sndstat.c), not
re-reported here; the panic log is preserved as
`snd_unload_df4116_panic.txt`. Guest was reset clean (`vm.sh reset with-src`)
afterwards.

## Exploit chain

(on real hardware) add ALS4000 card → induce pcm_register failure during
attach (e.g., raise unit count past hw.snd.maxunit/PCMMAXUNIT with many sound
cards, or pcm_veto_load from a failed sound init) → 0666 /dev/mixerN left
over freed softc → unprivileged MIXER_WRITE hammers freed M_DEVBUF slab →
heap groom → `als_mix_wr` writes attacker-influenced bytes to I/O ports via
stale handles and RMW's freed memory (family impact ceiling; gated behind
rare attach failure, hence Low).

## Fix validation

not_testable (no reproduced corruption; no hardware).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.