# DF-4727 — PoC evidence pack

**Finding:** `chn_intr(au->pch.channel)` with NULL channel in the attach
window between `snd_setup_intr` (aureal.c:620) and `pcm_addchan` (:653);
`au_testirq` enables AU_IRQ_PCMOUT inside that window → NULL-deref panic.

## Contents
- `VERDICT.md` — path:line trace incl. chn_intr's unconditional lock deref.
- `verdict.json` — machine verdict (status: untested; hw-gated).
- `fix.diff` — NULL guard.

## Reproduce / Expected
Requires the AU8820 card and a PCMOUT-sourced interrupt before the channel
exists (spurious/crafted hardware). Not reproducible in QEMU.