{
  "finding_id": "DF-4724",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "15th instance of the DF-4156 mixer-UAF family: au_pci_attach publishes the 0666 /dev/mixerN (mixer_init, aureal.c:634) before bus_dma_tag_create (aureal.c:636-645) and pcm_register (aureal.c:651) can still fail; the bad: unwind (aureal.c:658-664) frees au with no mixer_uninit, and DragonFly newbus never detaches a failed attach (subr_bus.c:2095-2117), so the node dangles into freed memory and any unprivileged users mixer ioctl reaches au_rdcd/au_wrcd over the freed au (aureal.c:126-169, 93-122). End-to-end UAF not runnable in QEMU (no Aureal PCI device); the load-bearing premise WAS verified live on the 6.5-DEVELOPMENT guest with a make_dev-then-fail KLD: /dev node persisted 0666 after attach returned 6 and unprivileged uid=1001 open() reached module code (see run.log, dmesg_premtest.txt). Note aureal.c is not wired into any build file today (no sys/conf/files entry, not in sys/dev/sound/driver/Makefile SUBDIR, no snd_aureal.ko in default builds), further gating reachability.",
  "exploit_chain": "",
  "evidence": "run.log (attach returned 6 + persistent crw-rw-rw- node + unpriv OPEN_RC=0 + open() reached module code), VERDICT.md, dmesg_premtest.txt, build.log, premtest.c",
  "kernel_refs": [
    "sys/dev/sound/pci/aureal.c:634",
    "sys/dev/sound/pci/aureal.c:636",
    "sys/dev/sound/pci/aureal.c:651",
    "sys/dev/sound/pci/aureal.c:658",
    "sys/dev/sound/pcm/mixer.c:make_dev",
    "sys/kern/subr_bus.c:2095"
  ],
  "poc_changes": "n/a (premise KLD written fresh; no seed existed)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "make SYSDIR=/usr/src/sys (in /tmp/premtest; see build.log)",
  "run_cmd": "kldload ./premtest.ko; sh -c exec 3<>/dev/premtest0 as uid=1001; dmesg",
  "code_hash": "dd56459dcf4f50b3eb83fde2cba976ab7a68f9692a0060e710073e89224ef624",
  "notes": "hw-gated (Aureal AU8820 PCI card required) + driver not in default build + attach-failure precondition; filed Low/memcorrupt/certain to match the 13 filed family instances (DF-4156..DF-4651). Premise (failed attach leaves live 0666 node reachable by unpriv users) dynamically verified on guest; the UAF itself needs the physical card.",
  "recommended_fix": "Call mixer_uninit(dev) on every failure after mixer_init() succeeds; also unwind in correct order (teardown intr, release irq/regs, free au last)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: the bug itself cannot be triggered on this guest (no Aureal PCI hardware), so no baseline panic/corruption exists to flip.",
  "fix_evidence": "fix.diff authored against read-only sys/ after line-level verification; not applied to sys/."
}