# DF-4726 — PoC evidence pack

**Finding:** aureal BAR loop stores bus tags/handles for up to 6 BARs into
`au->st[3]`/`au->sh[3]` — OOB kernel write over `parent_dmat`/`lock`/`x[]`.

## Contents
- `VERDICT.md` — root cause, adjacency analysis, path:line.
- `verdict.json` — machine verdict (status: untested; hw-gated).
- `fix.diff` — capacity check + store under mapped-count `j`.

## Reproduce / Expected
Requires a crafted PCI device with DID 0x000112eb advertising ≥4 allocatable
BARs (evil-peripheral / passthrough threat model) — not present in QEMU.
Static proof: `sys/bus/pci/pcivar.h:44` (PCI_MAXMAPS_0 = 6) vs
`aureal.c:76-77` (`st[3]`, `sh[3]`) with write sites at `aureal.c:592-593`.