DF-4651 fm801 mixer-UAF trigger preconditions:
  1. PCI audio function 1319:0801 (ForteMedia FM801) present
  2. attach reaches mixer_init() successfully (AC97 codec answers via FM_CODEC_CMD protocol, fm801.c:210-238)
  3. IRQ alloc/snd_setup_intr fails (fm801.c:625-627), or bus_dma_tag_create fails (fm801.c:636-638), or pcm_register() fails (fm801.c:646)
  4. unprivileged user opens the surviving 0666 /dev/mixerN -> mixer_ops -> freed snd_mixer/ac97_info/fm801_info

This guest: see pciconf output in run.log / env.txt.
probe done
--- pciconf vendor 1319 (ForteMedia) ---
NO 1319 PCI function on this guest
--- sound devices ---
no sndstat
--- QEMU ---
QEMU Virtual CPU version 2.5+
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
DF-4651 fm801 mixer-UAF trigger preconditions:
  1. PCI audio function 1319:0801 (ForteMedia FM801) present
  2. attach reaches mixer_init() successfully (AC97 codec answers via FM_CODEC_CMD protocol, fm801.c:210-238)
  3. IRQ alloc/snd_setup_intr fails (fm801.c:625-627), or bus_dma_tag_create fails (fm801.c:636-638), or pcm_register() fails (fm801.c:646)
  4. unprivileged user opens the surviving 0666 /dev/mixerN -> mixer_ops -> freed snd_mixer/ac97_info/fm801_info

This guest: see pciconf output in run.log / env.txt.
probe done
--- pciconf -l (full) ---
hostb0@pci0:0:0:0:	class=0x060000 card=0x11001af4 chip=0x12378086 rev=0x02 hdr=0x00
isab1@pci0:0:1:0:	class=0x060100 card=0x11001af4 chip=0x70008086 rev=0x00 hdr=0x00
atapci0@pci0:0:1:1:	class=0x010180 card=0x11001af4 chip=0x70108086 rev=0x00 hdr=0x00
none0@pci0:0:1:3:	class=0x068000 card=0x11001af4 chip=0x71138086 rev=0x03 hdr=0x00
vgapci0@pci0:0:2:0:	class=0x030000 card=0x11001af4 chip=0x11111234 rev=0x02 hdr=0x00
virtio_pci0@pci0:0:3:0:	class=0x020000 card=0x00011af4 chip=0x10001af4 rev=0x00 hdr=0x00
virtio_pci1@pci0:0:4:0:	class=0x010000 card=0x00021af4 chip=0x10011af4 rev=0x00 hdr=0x00
--- QEMU audio device models available (host-side fact):
     -device help lists sound models; the running guest was booted
     without any FM801 (1319:0801) function; QEMU 7.2 has no fm801
     model at all (only AC97, ES1370, intel-hda, sb16) ---