# DF-4724 — PoC evidence pack

**Finding:** aureal attach failure after mixer_init() leaves live 0666 /dev/mixerN
over freed `au` — DF-4156 mixer-UAF family, 15th instance.

## Contents

- `premtest.c` + `Makefile` + `build_and_load.sh` — premise-verification KLD:
  a driver whose attach() does make_dev(0666) then returns ENXIO, exactly the
  aureal mixer_init-success + goto-bad shape. Probe only matches the unbound
  PIIX4 PM function (0x7113:8086) so it cannot hijack real devices.
- `build.log` — full guest compiler output (successful KLD build).
- `run.log` — decisive runtime output: attach failed, node persisted 0666,
  unprivileged open() reached module code, clean unload.
- `dmesg_premtest.txt`, `env.txt` — guest kernel messages / environment.
- `VERDICT.md` — full narrative with path:line citations.
- `verdict.json` — machine verdict (status: untested; hw-gated, premise verified).
- `fix.diff` — git-apply-able fix (mixer_uninit on post-mixer failure paths);
  authored against the read-only sys/ tree, never applied there.

## Reproduce

```
# on a DragonFly guest with /usr/src:
make -C /tmp/premtest SYSDIR=/usr/src/sys    # build
kldload ./premtest.ko                        # attach runs, then FAILS ENXIO
ls -l /dev/premtest*                         # node persists, crw-rw-rw-
# as an unprivileged user:
sh -c 'exec 3<>/dev/premtest0'; echo $?      # -> 0
dmesg | tail                                 # -> open() reached module code
kldunload premtest                           # cleanup (real driver has none)
```

## Expected

The `/dev` node survives the failed attach with 0666 perms and dispatches to
the module — in the real aureal driver those dispatches would dereference the
already-freed `au` softc (`au_rdcd`/`au_wrcd` → `au_rd`/`au_wr` via
`au->st[]`/`au->sh[]`), a UAF read/write. The physical AU8820 card required
for the end-to-end UAF is not present in QEMU; that part is code-verified only
(see VERDICT.md).