# DF-4651 — fm801 attach-failure mixer-UAF (DF-4156 family, 14th instance)

`fm801_pci_attach()` publishes the 0666 `/dev/mixerN` at `mixer_init()`
(fm801.c:620) and keeps three failure paths after it — IRQ setup
(:625-627), dma tag (:636-638), pcm_register (:646). `oops:` then
`ac97_destroy()`s the codec (:657) and kfrees the softc (:662) while the
mixer cdev still dispatches open/ioctl into them: use-after-free with
kobj indirect dispatch. Secondary: `oops:` releases the register window
(:658) before `bus_teardown_intr` (:659) — live handler over unmapped
MMIO.

## Build (guest, root)

```sh
cd /root/df801 && sh build.sh
# cc -O -Wall -o /tmp/fm801_probe fm801_probe.c ; runs the probe +
# captures pciconf/sndstat evidence
```

## Run

```sh
sh run.sh    # probe + full pciconf -l
```

## Expected output

The probe prints the trigger preconditions and this guest's hardware
absence:

```
NO 1319 PCI function on this guest
no sndstat
```

The UAF itself needs a real FM801 (1319:0801) card whose attach passes
mixer_init() then fails late — impossible under QEMU 7.2.22 (no FM801
device model). The source chain is walked line-by-line in VERDICT.md.

## Fix validation

```sh
sh fix_validate.sh
# patches the guest /usr/src copy with fix.diff, builds snd_fm801.ko
# with the full kernel warning set (incl. -Werror) -- compiles clean;
# restores the pristine source afterwards (md5-verified).
```