--- a/sys/dev/sound/pcm/dsp.c +++ b/sys/dev/sound/pcm/dsp.c @@ -3046,6 +3046,13 @@ dsp_oss_syncstart(int sg_id) needlocks = 1; ret = 0; /* Assumes ret == EAGAIN... */ + /* DF-3880: lksleep() dropped the syncgroup + * lock while we slept, so sg and sm may + * already be freed by a concurrent + * SYNCSTART. Restart the scan from the + * list head instead of resuming the walk + * over freed members. */ + break; } } } while (needlocks && ret == 0);