Unrelated side-observation captured during fix validation (NOT part of DF-4026):

`kldunload snd_hda; kldunload sound` (root-only) panics during module
teardown (serial console, 2026-09-17 16:4x UTC, DF 6.5-DEVELOPMENT
X86_64_GENERIC):

    pcm0: detached
    hdaa0: detached
    hdacc0: detached
    hdac0: detached
    panic: sbuf_delete called with uninitialized or corrupt sbuf
    cpuid = 4
    Trace beginning at frame 0xfffff8011817f828
    _assert_sbuf_integrity() at _assert_sbuf_integrity+0x42 0xffffffff806a0a12
    _assert_sbuf_integrity() at _assert_sbuf_integrity+0x42 0xffffffff806a0a12
    sbuf_delete() at sbuf_delete+0x1b 0xffffffff806a172b
    sndstat_sysuninit() at sndstat_sysuninit+0x8c 0xffffffff8271246c
    linker_file_unload() at linker_file_unload+0x3aa 0xffffffff8062437a
    linker_file_unload() at linker_file_unload+0x14e 0xffffffff8062411e
    Debugger("panic")

sys/dev/sound/pcm/sndstat.c sysuninit frees an sbuf that was never
initialized when the module is unloaded without any /dev/sndstat open
having initialized it.  Root-only administrative action required to
trigger; filed as a note only (would be Low/Info as a standalone).