--- a/sys/dev/sound/pci/solo.c
+++ b/sys/dev/sound/pci/solo.c
@@ -1057,6 +1057,12 @@ ess_attach(device_t dev)
 
 no:
+	/*
+	 * mixer_init() (line 1045) published /dev/mixerN with si_drv1 -> m
+	 * and m->devinfo == sc.  Unwind it before the softc is freed or the
+	 * cdev dangles into freed memory (DF-4156 family).  Harmless (EBADF)
+	 * for the failure paths that precede mixer_init().
+	 */
+	mixer_uninit(dev);
     	ess_release_resources(sc, dev);
     	return ENXIO;
 }