--- a/sys/dev/sound/pci/via8233.c
+++ b/sys/dev/sound/pci/via8233.c
@@ -1328,11 +1328,25 @@
 	if (via_chip_init(dev))
 		goto bad;
 
+	/*
+	 * pcm_register() must precede mixer_init(): mixer_init() publishes a
+	 * 0666 /dev/mixerN whose devinfo is the AC97 codec created below.
+	 * Were pcm_register() to fail after a successful mixer_init(), the
+	 * bad: unwind below would ac97_destroy() the codec while /dev/mixerN
+	 * still dispatches ioctls into it (UAF) -- DF-4334, same family as
+	 * DF-4156/DF-4193/DF-4299.  With pcm_register() first, no failure
+	 * path exists after the mixer is created, keeping the unwind
+	 * symmetric.
+	 */
+	if (pcm_register(dev, via, via_dxs_chnum + via_sgd_chnum, NWRCHANS))
+	      goto bad;
+
 	via->codec = AC97_CREATE(dev, via, via_ac97);
 	if (!via->codec)
 		goto bad;
 
-	mixer_init(dev, ac97_getmixerclass(), via->codec);
+	if (mixer_init(dev, ac97_getmixerclass(), via->codec))
+		goto bad;
 
 	via->codec_caps = ac97_getextcaps(via->codec);