# DF-5555 — usb_template_audio.c CDC-renumber misfire census (pass 2)

**File:** `sys/bus/u4b/template/usb_template_audio.c` (396 LOC)
**Class:** structural harness, same evidence family as DF-5553
(`usb_template_phone.c`). Deterministic, no guest state required beyond a
compiler.

## What this proves

The template core's `usb_make_raw_desc()`
(`sys/bus/u4b/template/usb_template.c:135-146,162-171`) classifies CDC
union / call-management descriptors only by
`(bLength >= 5, type == 0x24, subtype in {6, 1})`. USB-Audio
CS_INTERFACE descriptors share type 0x24 with those subtypes, so the
heuristic fires on this template's tables too. Census (9 hits):

| descriptor | subtype | true meaning | iface | delta |
|---|---|---|---|---|
| `audio_raw_desc_0` (usb_template_audio.c:96) | 0x01 | AC header (`bcdADC` hi byte at [4]) | 0 | +0 |
| `audio_raw_desc_9..14` (lines 141-169) | 0x06 | feature units (`bUnitID`[3]/`bSourceID`[4]) | 0 | +0 |
| `audio_raw_desc_20` (line 205) | 0x01 | **AS_GENERAL (`bDelay` at [4])** | **1** | **+1: 0x03→0x04** |
| `audio_raw_desc_30` (line 273) | 0x01 | **AS_GENERAL (`bDelay` at [4])** | **2** | **+2: 0x01→0x03** |

Two real corruptions of generated descriptors (in-bounds; offset 4 <
bLength 7), seven zero-delta misclassifications. No memory unsafety.

## Build

```
cd findings/poc/DF-5555
./build.sh          # or: scp to the guest and run there (see VERDICT.md)
```

`build.sh` sed-extracts the audited file's body VERBATIM from the guest's
`/usr/src` (sha256 must equal the audit tree's
`dd3d65e17a662a75d02ffada2158c72aef47359cf1dd9a07c4f489ea9e26a535`)
into `audio_body.inc` and compiles `table_check.c` (which `#include`s it)
twice: stock, and `-DFIX_CLASSGATE` (fix.diff's class gate).

## Run

```
./run.sh            # baseline replay + S1-S8 + fix-logic check
```

## Expected output (decisive lines)

```
  HIT    audio_raw_desc_20 ... in iface 1: CDC-CM patch byte[4] (bDelay) delta=+1  <-- REAL DELTA
  HIT    audio_raw_desc_30 ... in iface 2: CDC-CM patch byte[4] (bDelay) delta=+2  <-- REAL DELTA
  MISFIRE ... byte[4] (bDelay) 0x03 -> 0x04  <-- CORRUPTED
  MISFIRE ... byte[4] (bDelay) 0x01 -> 0x03  <-- CORRUPTED
  -> census: 9 descriptor(s) satisfy the CDC predicate; 2 in nonzero interfaces ...
  ALL STRUCTURAL CHECKS PASSED
  MISFIRE lines under FIX_CLASSGATE: 0 (expected 0)
```

Exit 0; `run.log` and `run.2.log` are byte-identical (deterministic).

Everything else the template-family checklist hunts is verified negative
by the same binary: S1 bLength==sizeof on all 22 raw tables, S2 all 9
pointer tables NULL-terminated without holes, S3 string descriptors
self-sized, S4 full 0..255 string-index sweep clean, S5 no vendor/HID
surface, S6 AC-header interface hardcodes match the numbering walk
(bInCollection=2, baInterfaceNr={1,2}, wTotalLength=169 exact), S7 speed
tables in-bounds/fail-closed, S8 audio-graph IDs all resolve.