# premise/reachability run on the audit guest (2026-09-23, root via vm.sh run_root)
$ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
$ ls -la /boot/kernel/snd_via82c686.ko /boot/kernel/sound.ko /boot/kernel/amdgpu.ko
-r-xr-xr-x  1 root wheel 124519200 Jun 29 14:24 /boot/kernel/amdgpu.ko
-r-xr-xr-x  1 root wheel   226248 Jun 29 14:24 /boot/kernel/snd_via82c686.ko
-r-xr-xr-x  1 root wheel   5137664 Jun 29 14:24 /boot/kernel/sound.ko
$ kldload snd_via82c686 && echo KLDLOAD_RC=0
KLDLOAD_RC=0
$ kldstat | grep -E "snd_via82c686|sound"
 4    1 0xffffffff82600000    1f000 snd_via82c686.ko
 5    1 0xffffffff8261f000   2bc000 sound.ko
$ ls /dev/mixer* /dev/dsp*
/dev/dsp
/dev/mixer
$ sysctl hw.snd | head -3
hw.snd.feeder_rate_quality: 1
hw.snd.feeder_rate_round: 25
hw.snd.feeder_rate_max: 2016000
$ pciconf -l | head
hostb0@pci0:0:0:0:  class=0x060000 card=0x11001af4 chip=0x12378086 rev=0x02 hdr=0x00
isab1@pci0:0:1:0:   class=0x060100 card=0x11001af4 chip=0x70008086 rev=0x00 hdr=0x00
atapci0@pci0:0:1:1: class=0x010180 card=0x11001af4 chip=0x70108086 rev=0x00 hdr=0x00
none0@pci0:0:1:3:   class=0x068000 card=0x11001af4 chip=0x71138086 rev=0x03 hdr=0x00
vgapci0@pci0:0:2:0: class=0x030000 card=0x11001af4 chip=0x11111234 rev=0x02 hdr=0x00
virtio_pci0@pci0:0:3:0: class=0x020000 card=0x00011af4 chip=0x10001af4 rev=0x00 hdr=0x00
virtio_pci1@pci0:0:4:0: class=0x010000 card=0x00021af4 chip=0x10011af4 rev=0x00 hdr=0x00

# => driver module ships, loads, and is wired into the build; no VIA 30581106
#    device exists on this guest, so no attach (and hence no attach-failure)
#    path executes. /dev/mixer + /dev/dsp above are the clone-basis nodes
#    created by sound.ko itself, not a mixer unit. The UAF itself needs the
#    physical VT82C686A card.
#
# BONUS (during this run, while unloading): live A/B reproduction of the
# already-filed DF-4116 (sndstat_sysuninit sbuf panic) — see
# DF-4116_live_repro/panic.txt:
#   1) cat /dev/sndstat; kldunload snd_via82c686  -> UNLOAD_AFTER_READ_RC=0 (benign)
#   2) kldload snd_via82c686                      -> RELOAD_RC=0 (fresh statics, sndstat unread)
#   3) kldunload snd_via82c686                    -> kernel panic, guest down