# DF-4334 — via_attach() late-failure path frees the AC97 codec while mixer_init()'s 0666 /dev/mixerN survives (mixer UAF)

File: `sys/dev/sound/pci/via8233.c` · pass 2 (GLM 5.3) · family: attach-error-path
(DF-4156 maestro, DF-4193 es137x, DF-4299 emu10kx-pcm)

## Build

```sh
# on the audit guest (root):
cc -O -Wall -o /root/via8233_probe /root/via8233_probe.c
```

## Run

```sh
./dfbsd-qemu/vm.sh run_root '/root/via8233_probe'
pciconf -l | grep 1106:3059        # -> nothing: no VIA audio function
ls /dev/mixer*                     # -> nothing: no pcm unit exists
```

## Expected

The probe cannot and does not trigger the UAF: the defect fires only when
`pcm_register()` fails *after* `mixer_init()` succeeded during
`snd_via8233` attach. On this guest no 1106:3059 PCI function exists
(host QEMU 7.2.22 predates the via-ac97 emulation added in QEMU 8.2), and
the `pcm_register()` failure preconditions (`pcm_veto_load` stuck at 1 —
cleared only by successful feeder init at boot; or pcm unit > 255) are
boot-time anomalies an unprivileged user cannot create. The probe records
that negative environment; the finding is source-certain
(`via8233.c:1335` vs `via8233.c:1354-1373`).

## Fix

`fix.diff` — reorder `pcm_register()` before `AC97_CREATE`/`mixer_init()`
and check `mixer_init()`'s return, eliminating every failure path after
the mixer is published (mirrors FreeBSD upstream, where `pcm_register()`
became void and the late-failure path no longer exists).