DF-4610 — neomagic attach-failure paths after mixer_init() leave a live
0666 /dev/mixerN over freed codec+softc (DF-4156 family, 13th instance).

BUILD (guest)
    cc -O -Wall -o /tmp/neomagic_probe /tmp/neomagic_probe.c

RUN (guest, any user)
    /tmp/neomagic_probe
    pciconf -l | grep 10c8      # absent on this guest (no NM256 in QEMU 7.2)

EXPECTED
    Probe prints the 4 trigger preconditions and exits 0; pciconf shows
    no 10c8:8005/8006 function.  The UAF itself cannot be exercised here:
    it needs real NM256 hardware whose attach succeeds through
    mixer_init() and then fails at the IRQ/pcm_register step.  Source
    chain and unwind walk-through: VERDICT.md.

FIX VALIDATION (build-only, on guest /usr/src copy)
    cd /usr/src && patch -p1 < fix.diff
    cd sys/dev/sound/driver/neomagic && make       # -Werror, clean
    (see build.log)