# DF-4551 — als_intr() runs before channel objects exist (and after they are freed): chn_intr(NULL) NULL-deref panic + teardown ordering

File: `sys/dev/sound/pci/als4000.c` lines 783, 648-658, 852-853, 861-863, 872, 741-748.

## Build / Run

Documentation/analysis PoC — the trigger is hardware behavior (an interrupt
arriving in the attach or detach window), not a program:

```
cc -Wall -c als_intr_window.c    # compile check only
```

On real hardware the reproducer is: install an ALS4000 sharing its IRQ line
with any active device (IRQ is requested RF_SHAREABLE, als4000.c:777), then
`kldload snd_als4000` / use the card and `kldunload snd_als4000` repeatedly
while the other device generates interrupts. An IRQ landing between
`snd_setup_intr` (als4000.c:783) and `pcm_addchan` (:852) executes
`chn_intr(sc->pch.channel == NULL)` -> `CHN_LOCKOWNED(c)` on NULL
(channel.c:683-694) -> panic.

## Guest result

Not reproducible: no ALS4000 PCI device in the QEMU guest
(guest_hw_evidence.txt) — `snd_als4000.ko` loads but never attaches, so
`als_intr` is never registered or called.