{
  "finding_id": "DF-4726",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "au_pci_attachs BAR loop (aureal.c:571-605) iterates over all PCI_MAXMAPS_0=6 (sys/bus/pci/pcivar.h:44) BARs but stores rman_get_bustag/bushandle into au->st[i]/au->sh[i] (aureal.c:592-593) where st/sh are size-3 arrays (aureal.c:76-77): a PCI device under this drivers ID advertising >=4 allocatable BARs makes attach write 24-48 bytes past the arrays over sh[0..2], parent_dmat, lock and x[0] \u2014 OOB kernel write (CWE-787) that corrupts the bus_dma_tag later dereferenced by sndbuf_alloc (aureal.c:310). Hardware-gated (crafted/cloned PCI device, evil-peripheral threat model); not reproducible in QEMU.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (array sizes vs loop bound, adjacency analysis), fix.diff",
  "kernel_refs": [
    "sys/dev/sound/pci/aureal.c:76",
    "sys/dev/sound/pci/aureal.c:77",
    "sys/dev/sound/pci/aureal.c:571",
    "sys/dev/sound/pci/aureal.c:592",
    "sys/dev/sound/pci/aureal.c:593",
    "sys/dev/sound/pci/aureal.c:310",
    "sys/bus/pci/pcivar.h:44"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "hw-gated: needs a crafted PCI device with DID 0x000112eb advertising >3 allocatable BARs (also not in default build). Driver only ever uses map 0, so nothing legitimate needs st[3+].",
  "recommended_fix": "Cap stored slots at sizeof(au->st)/sizeof(au->st[0]) and index by the mapped count j, not the BAR index i",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: requires crafted PCI hardware absent from the QEMU guest.",
  "fix_evidence": "fix.diff authored against read-only sys/."
}