{
 "finding_id": "DF-4677",
 "poc_id": "DF-4677",
 "status": "untested",
 "reproduced": 0,
 "impact": "cmx_detach lifetime holes: unlocked dying TOCTOU across lockuninit, and registered knotes never detached from ki_note - post-free knote cleanup is a UAF write",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "dying set unlocked, lockuninit before fds drain, KNOTE only when polling. device_busy + unconditional-KNOTE + dying-under-lock fix.",
 "kernel_refs": [
  "sys/dev/misc/cmx/cmx.c:272",
  "sys/dev/misc/cmx/cmx.c:290"
 ],
 "verdict": "not_run: root+physical gated; race variant same gating",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware-gated (no Bt848 / no CardMan on guest)",
 "fix_evidence": "fix in finding markdown"
}