# DF-4847 — VERDICT

**status: reproduced** (feeder level, real unmodified code on the audit guest)
**primitive:** up to ialign−1 byte OOB write past the destination window
(including window-preceding underwrite via the :501 misround) + return
over-report into sndbuf_acquire (ring overflow)
**confidence: certain**

## Root cause

Shared table defect (snd_fxdiv_gen.awk calcdiv single-point validation — see
DF-4846 VERDICT for the exhaustive enumeration) consumed on the caller's
window by `feed_matrix_feed`:

- `feeder_matrix.c:479` `count = SND_FXROUND(count, info->oalign)` —
  misround ⇒ count' > count: the source fill and matrixing pass are sized
  past the window.
- `:494-506` for ialign>oalign: `j = SND_FXROUND(count - info->oalign,
  info->ialign)` — misround ⇒ j up to count+ialign−oalign−1 > count ⇒
  `src = dst + count - j < dst` — the source writes BEFORE the destination
  window and past its end.
- `:509` `SND_FXDIV(FEEDER_FEED(...), ialign)` — frame miscount on partial
  user-paced returns; `apply()` then processes frames the source never
  delivered.

## Reproduction (guest, pristine file)

`ffmat` (`mat.log`): `checks=23706 failures=4891`, decisive:

```
FAIL[T2 upmix ialign=4<oalign=12] in_ch=2 out_ch=6 count=8195 ret=8184 REAR guard (write past window) maxwrite_off=8196 maxask=2728
```

count=8195 is the first bad value for align 12 (`FXROUND(8195,12)=8196`):
a 2ch→6ch upmix writes past the 8195-byte window (maxwrite_off 8196).

Note: the previous pass-2 result for this file ("clean, 220k iterations")
did not include the bad-residue count enumeration; the defect is
deterministic arithmetic, not timing.

## Kernel reachability

feeder_build_matrix (feeder_chain.c:284-336) on any channel-count mismatch —
unprivileged SNDCTL_DSP_CHANNELS (2↔6/7 etc.); default chain. Counts as in
DF-4846 (buffer.c:705-709). In-kernel churn: no differential anomaly vs
aligned control on this no-INVARIANTS kernel (DF-4849 pack logs) — same
reasoning as DF-4710/DF-4846.

## Fix validation

`fix.diff` (generator, shared): baseline 4891 failures → fixed **0 (ALL
PASS)** (`mat.log` vs `mat_fixed.log`). Fixed table exhaustively exact for
all 44 divisors over [1,65536]. fix_status: fixed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.