{"finding_id":"DF-4963","status":"untested","attempts":0,"reproduced":0,"impact":"corruption","confidence":"certain","verdict":"Hardware-gated (no RME 10ee:3fc6 on guest): hdspe_attach creates the lock, enables busmaster, maps BAR0, registers hdspe_intr and allocates DMA - then every error return (rev default, alloc_resources inner failures, init failure, bus_generic_attach failure) exits without releasing anything, and DFly newbus never detaches a failed attach: the IRQ cookie/rman/dmat/pbufs/lock all leak AND the ICU keeps dispatching hdspe_intr on a dead device - kldunload snd_hdspe then leaves the vector armed over unmapped module text (next audio IRQ = wild ring-0 jump). Boot-conditioned + root-unlock-gated. Mirror-the-detach unwind fix.","exploit_chain":"attach fails after bus_setup_intr -> no unwind -> kldunload snd_hdspe -> module text unmapped, vector armed -> IRQ fires -> jump to freed text","evidence":"findings/poc/DF-4963/ (this verdict; code-trace proof)","kernel_refs":["sys/dev/sound/pci/hdspe.c:279-333","sys/dev/sound/pci/hdspe.c:126-201","sys/kern/subr_bus.c:2100-2124"],"guest_uname":"","code_hash":""}