{
  "finding_id": "DF-4700",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Analysis-certain locking defect: hdspechan_setspeed() RMW-writes the shared sc->ctrl_register and writes CONTROL/FREQ registers with no sc->lock (hdspe-pcm.c:486-498) while the sibling ops (setblocksize:547-552, trigger->start/stop_audio:222-239) do the same under sc->lock. Play and record channels hold different CHN locks, so a setspeed on one channel races trigger/setblocksize on another: lost updates on ctrl_register can resurrect HDSPE_ENABLE/AUDIO_INT_ENABLE after stop (interrupt storm) or scramble latency/frequency bits. Functional/DoS impact only; requires real RME HDSPe hardware (no emulator exists), so PoC left untested by design.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4700/README.md; hdspe-pcm.c:486-498 vs :547-552 and :222-239",
  "kernel_refs": [
    "sys/dev/sound/pci/hdspe-pcm.c:486",
    "sys/dev/sound/pci/hdspe-pcm.c:488",
    "sys/dev/sound/pci/hdspe-pcm.c:498",
    "sys/dev/sound/pci/hdspe-pcm.c:547",
    "sys/dev/sound/pci/hdspe-pcm.c:354"
  ],
  "poc_changes": "no seed; analysis-only pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "requires physical RME HDSPe AIO/RayDAT hardware (PCI 10ee:3fc6); no QEMU device model exists",
  "fix_evidence": "",
  "notes": "Low severity. Full pass-2 negative results for the rest of hdspe-pcm.c are in the audit result block (rate/latency table walks safe, blocksize clamped, buffer_copy in-bounds by 8-byte alignment, mixer-UAF family absent, device_get_children cannot fail (M_INTWAIT), getptr bounded).",
  "recommended_fix": "Take snd_mtxlock(sc->lock) around the ctrl_register/FREQ_REG update tail of hdspechan_setspeed(), mirroring hdspechan_setblocksize()."
}