# DF-4725 — PoC evidence pack

**Finding:** aureal attach `bad:` unwind frees `au` before `bus_teardown_intr`
(live `au_intr` over freed softc — UAF write in interrupt context) and can
hand NULL `reg[]` entries to `bus_release_resource` (NULL-deref panic).

## Contents
- `VERDICT.md` — full narrative with path:line citations.
- `verdict.json` — machine verdict (status: untested; hw-gated).
- `fix.diff` — reorder unwind + NULL-guard + `if (reg[j]) j++`.

## Reproduce / Expected
Not runnable in QEMU: requires an Aureal Vortex AU8820 PCI card whose attach
fails after `snd_setup_intr` succeeded. Static trace in VERDICT.md.

See DF-4724's `run.log` for the same newbus attach-failure semantics verified
live on the guest.