{
  "finding_id": "DF-4727",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "au_intr (aureal.c:396-433) calls chn_intr(au->pch.channel) at :413 whenever intsrc & AU_IRQ_PCMOUT, but au->pch.channel is NULL until pcm_addchan (aureal.c:653) -> auchan_init (:306) assigns it; the IRQ is live from snd_setup_intr (aureal.c:620) and au_testirq (:625, body :528-537) explicitly enables AU_IRQ_PCMOUT (IRQEN 0x1030 includes 0x20) and raises an interrupt, leaving >1s of enabled-IRQ window; chn_intr (channel.c:683) unconditionally does CHN_LOCKOWNED(c) = lockstatus(c->lock) (channel.h:312) -> NULL-deref panic in interrupt context. Healthy hardware raises the test irq as AU_IRQ_UNKNOWN so the window normally passes quietly — Low/likely, hw-gated, not reproducible in QEMU.",
  "exploit_chain": "",
  "evidence": "VERDICT.md path:line trace; fix.diff",
  "kernel_refs": ["sys/dev/sound/pci/aureal.c:411", "sys/dev/sound/pci/aureal.c:413", "sys/dev/sound/pci/aureal.c:531", "sys/dev/sound/pci/aureal.c:620", "sys/dev/sound/pci/aureal.c:653", "sys/dev/sound/pcm/channel.c:683", "sys/dev/sound/pcm/channel.h:312", "sys/dev/sound/pci/aureal.h:56"],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "hw-gated (AU8820 + spurious PCMOUT irq in the pre-channel window). Guard is one line; matches how other DF sound drivers gate chn_intr.",
  "recommended_fix": "NULL-guard chn_intr(au->pch.channel) in au_intr; enable PCMOUT irq only after pcm_addchan",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: requires physical AU8820 card and a spurious PCMOUT interrupt during attach.",
  "fix_evidence": "fix.diff authored against read-only sys/."
}