{
  "finding_id": "DF-4553",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Copy-paste defect at vibes.c:653: sv_suspend() aborts sc->pch (playback) with svrchan_trigger (the RECORD trigger), which only clears SV_RECORD_ENABLE (vibes.c:345-350). The playback DMA engine (DMAA) is therefore never disabled at suspend and keeps bus-mastering while the system suspends; the record engine is disabled twice. Not reproduced on the audit guest: no 5333:ca00 PCI device exists there, so the device suspend path cannot be exercised. Security impact bounded to device/PM misbehavior (continued DMA across suspend, stale-enable state on resume); no kernel memory-safety impact.",
  "exploit_chain": "",
  "evidence": "vibes.c:653 svrchan_trigger on &sc->pch; svrchan_trigger STOP/ABORT arm at vibes.c:345-350 touches only SV_RECORD_ENABLE; contrast svpchan_trigger STOP/ABORT at vibes.c:422-427 which clears SV_PLAY_ENABLE",
  "kernel_refs": [
    "sys/dev/sound/pci/vibes.c:653",
    "sys/dev/sound/pci/vibes.c:345",
    "sys/dev/sound/pci/vibes.c:422"
  ],
  "poc_changes": "authored from scratch this pass (no seed; finding filed this pass)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a (kernel state machine)",
  "run_cmd": "sh run.sh (documents trigger + guest hardware absence)",
  "code_hash": "1c98c5c61290bd3e7c70fb1973fbbff3954c25e9d324862ba0d6940de3733484",
  "notes": "One-token fix; matches upstream FreeBSD where sv_suspend uses svpchan_trigger for the playback channel. Hardware-dependent; not exercisable in QEMU.",
  "recommended_fix": "vibes.c:653: use svpchan_trigger for sc->pch in sv_suspend (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable: no SonicVibes hardware in the QEMU guest; fix is a one-token correction identical to upstream FreeBSDs driver",
  "fix_evidence": "fix.diff"
}