--- a/sys/dev/sound/pci/als4000.c
+++ b/sys/dev/sound/pci/als4000.c
@@ -839,17 +839,22 @@ als_pci_attach(device_t dev)
 		goto bad_attach;
 	}
 
+	if (pcm_register(dev, sc, 1, 1)) {
+		device_printf(dev, "failed to register pcm entries\n");
+		goto bad_attach;
+	}
+
+	/* mixer_init() publishes a 0666 /dev/mixerN holding devinfo=sc
+	 * (mixer.c:635,730-732); it must only be called once every path
+	 * that could still free sc is closed, and any failure after
+	 * pcm_register() must pcm_unregister() first (mixer-UAF family). */
 	if (mixer_init(dev, &als_mixer_class, sc)) {
 		device_printf(dev, "failed to initialize mixer\n");
+		pcm_unregister(dev);
 		goto bad_attach;
 	}
-
-	if (pcm_register(dev, sc, 1, 1)) {
-		device_printf(dev, "failed to register pcm entries\n");
-		goto bad_attach;
-	}
 
 	pcm_addchan(dev, PCMDIR_PLAY, &alspchan_class, sc);
 	pcm_addchan(dev, PCMDIR_REC,  &alsrchan_class, sc);