{
  "finding_id": "DF-4743",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "16th instance of the DF-4156 mixer-UAF family: via_attach publishes the 0666 /dev/mixerN at mixer_init (via82c686.c:548; make_dev+si_drv1=m at mixer.c:730-733, m->devinfo=codec) and keeps five failure paths after it (bus_dma_tag_create x2 at 556-565/572-582, bus_dmamem_alloc at 584-586, bus_dmamap_load at 587-589, pcm_register at 596); the bad: unwind frees the codec (ac97_destroy at 602, kfree at ac97.c:858) and via (611) with no mixer_uninit, and DragonFly newbus never detaches a failed attach, so the cdev dangles into freed memory - any unprivileged mixer open/ioctl reaches via_read_codec/via_write_codec (via82c686.c:180-209) over freed codec+softc+lock. End-to-end not runnable in QEMU (no VIA 1106:3058 on pciconf -l, see run.log); the load-bearing family premise (failed attach leaves live 0666 node reachable by unpriv users) was dynamically verified on this same guest kernel by DF-4724s run. Driver IS wired into the build and ships in /boot/kernel (sys/conf/files:2156, sys/dev/sound/driver/Makefile:5) - unlike the aureal sibling - so only the card is missing.",
  "exploit_chain": "",
  "evidence": "run.log (module ships/loads, no hw on PCI bus), VERDICT.md (full static chain + killed-candidate list incl. the via_buildsgdt unbounded-segs analysis killed by round_blksz floor channel.c:1591-1609), DF-4116_live_repro/ (bonus live panic)",
  "kernel_refs": [
    "sys/dev/sound/pci/via82c686.c:548",
    "sys/dev/sound/pci/via82c686.c:596",
    "sys/dev/sound/pci/via82c686.c:602",
    "sys/dev/sound/pci/via82c686.c:611",
    "sys/dev/sound/pcm/mixer.c:730",
    "sys/dev/sound/pcm/ac97.c:852"
  ],
  "poc_changes": "n/a (no seed; premise evidence gathered live)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "kldload snd_via82c686; kldstat; pciconf -l; ls /dev/mixer* (see run.log)",
  "code_hash": "sha256:0000-n-a-static-trigger",
  "notes": "Filed Low to match the 15 family instances. Bonus: DF-4116 (sndstat_sysuninit sbuf panic) live-reproduced twice during this run - controlled A/B (read-then-unload OK vs reload-then-unload panic), evidence in DF-4116_live_repro/; recommend orchestrator persist DF-4116 as reproduced/panic via persist_poc.py. Guest reset clean (vm.sh reset with-src) after the panic.",
  "recommended_fix": "mixer_uninit(dev) + via->codec=NULL on every failure after mixer_init() succeeds (fix.diff; family idiom from DF-4724)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: the UAF cannot be triggered on this guest (no VT82C686A hardware). diff is line-exact against the verified bad: unwind.",
  "fix_evidence": "fix.diff (bad_mixer label + mixer_uninit before the free path; ac97mix_uninit frees the codec so codec=NULL prevents the bad:-path double free)"
}