# DF-4538 — cs4281_pci_detach() releases the BA0/BA1 register mappings before tearing down the interrupt handler that reads them

## What this is
`cs4281_pci_detach()` (cs4281.c:878-901) releases the BA0 register window
(cs4281.c:893) and the BA1 memory window (cs4281.c:894) **before**
`bus_teardown_intr()` (cs4281.c:895). The interrupt handler
(`cs4281_intr`, registered at cs4281.c:812, shared-IRQ capable per
cs4281.c:806 `RF_SHAREABLE`) reads `CS4281PCI_HISR`/`HDSR` through those
mappings (`cs4281_rd`, cs4281.c:146-150) on every line assertion, and
`pcm_unregister()` does not unregister the handler. During the window
between the two releases and the teardown, an interrupt (its own or a
shared line level) dispatches into bus_space reads of already-released
rman resources — use-after-release of the register mapping, typically a
kernel panic.

Sibling drivers get the order right (es137x.c:1917-1919 tears down the
interrupt before releasing IRQ and registers); cs4281 (and its `bad:`
unwind at cs4281.c:867-870, which has the same inverted order) does not.

Trigger: root unloading `snd_cs4281` (`kldunload`) while the device
raises or shares an interrupt. Unprivileged users cannot reach this;
severity Low.

## Build / run
```
./build.sh    # guest build of the environment probe
./run.sh      # documents: no CS4281 hardware on this guest (detach path unreachable)
```

## Fix
`fix.diff` moves `bus_teardown_intr()` + IRQ release ahead of the BA0/BA1
register releases in `cs4281_pci_detach()`, matching es137x.c:1917-1919.
`git apply --check` clean; never applied to sys/.