# DF-4550 — als4000: attach-failure path after mixer_init leaves a live 0666 /dev/mixerN over freed softc (mixer-UAF family, 11th instance)

File: `sys/dev/sound/pci/als4000.c` lines 842-863.

## Build / Run

```
cc -o /tmp/mixer_uaf_exerciser mixer_uaf_exerciser.c
/tmp/mixer_uaf_exerciser /dev/mixerN    # only exists after an als4000 attach
```

## Expected output (on real hardware, after a pcm_register() failure)

MIXER_WRITE ioctls succeed while reading/writing through the FREED `sc`
(use-after-free in `alsmix_set` — als4000.c:574-603 — reading stale
`sc->st`/`sc->sh` bus handles and RMW-ing freed heap); typically crashes or
corrupts once the slab is reused.

## Guest result

**Not reproducible in QEMU:** no ALS4000 PCI device (`ALS_PCI_ID0
0x40004005`) exists in the guest — `snd_als4000.ko` loads but `als_pci_attach`
never runs (see `guest_hw_evidence.txt`). The dangling-/dev/mixerN trigger
(add the card + force `pcm_register` failure: `pcm_veto_load` set, unit >
PCMMAXUNIT, or ENOMEM inside pcm_register — sound.c:1021-1033) cannot be
constructed on this guest.

Note: `kldunload snd_als4000` during exploration panicked the guest in
`sndstat_sysuninit` — that is the already-filed **DF-4116** (sound.ko unload
bug), a different finding not re-reported here (see
`snd_unload_df4116_panic.txt`).