{
  "finding_id": "DF-4725",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "au_pci_attachs bad: unwind (aureal.c:658-664) frees au at :659 while au_intr is still registered (snd_setup_intr at :620; IRQs enabled by au_testirq :528-537 / au_init :505) until bus_teardown_intr at :662 \u2014 any interrupt in that window writes au->interrupts++ and does bus_space IO through the freed softc (UAF in hardirq context). Additionally the BAR loops `if (mapped) j++` at :599 advances j past allocations that failed after any earlier success, so :661 releases NULL reg[] entries -> NULL-deref panic in rman. Hardware-gated (AU8820 PCI card + attach failure); not runnable in QEMU; source-trace verified.",
  "exploit_chain": "",
  "evidence": "VERDICT.md with path:line trace; fix.diff",
  "kernel_refs": [
    "sys/dev/sound/pci/aureal.c:599",
    "sys/dev/sound/pci/aureal.c:620",
    "sys/dev/sound/pci/aureal.c:658",
    "sys/dev/sound/pci/aureal.c:659",
    "sys/dev/sound/pci/aureal.c:661",
    "sys/dev/sound/pci/aureal.c:662",
    "sys/dev/sound/pci/aureal.c:401"
  ],
  "poc_changes": "n/a (no runtime PoC possible without the card)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "hw-gated (Aureal AU8820 required; driver not in default build). Same attach-failure precondition family as DF-1506 (emu10kx dangling IRQ consumer).",
  "recommended_fix": "Unwind in order: teardown intr, release irq, release non-NULL regs, free au last; count j only for mapped BARs",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: bug requires physical AU8820 hardware and an attach failure; not reproducible on the QEMU guest.",
  "fix_evidence": "fix.diff authored against read-only sys/; ordering semantics checked against subr_bus.c teardown requirements."
}