And next to every PC has at least a speaker for the BIOS beep. I'm not sure how good the DAC driver chip is (especially, how they perform at ultrasonic or subsonic frequencies).

The PC speaker does not have much of a DAC. Before the common use of ASIC chipsets, the PC speaker was connected to one of the channels of a clock divider chip. The other channel was used to drive the timer IRQ.

When a program wanted to produce a tone, the program took the input frequency of the clock divider divided by the desired frequency and programmed it into the clock divider. To control the duration of the tone, a DOS or BIOS call was available delay the program or the program could hook the timer interrupt vector. The program would then turn the speaker off or start the next tone.

Programs could also turn the output bit on and off manually. Some programs could turn the bit on and off rapidly to play arbitrary sounds. There was even a Windows driver to play sound through the PC speaker, but it disabled interrupts, causing the clock, keyboard, mouse, and network to stop while the sound was playing.

If the speaker is physically capable of that, the same technique can output ultrasound - with modern processor speeds, you probably could twiddle that output bit while still leaving room for normal system operation.

Now that's an interesting piece of history. Thanks!

I was thinking about this too. If it's possible to send out arbitrary frequencies with it you could have a one way channel even if the air gapped machine doesn't have a mic. Only the receiver would need one. The air gapped machine would just be transmitting 24/7 hoping another machine is in range.

Quite like a navigation beacon...

Schneier admitted his airgapped machine was laptop. But I supposed he has the good sense to physically damage the mic, speakers and wifi and Bluetooth.