chn_removefeeder leaves stale parent pointer on new chain head (latent UAF)

Summary

chn_removefeeder L253-265 unlinks top feeder f: c->feeder=c->feeder->source; feeder_destroy(f). Never clears f->source->parent (now c->feeder->parent). New chain head carries parent pointer into freed heap. Chain invariant X->parent==owner_of_X silently broken until next chn_addfeeder. Sibling chn_addfeeder L236-251 correctly maintains c->feeder->parent=nf. Only parent-pointer walker is /dev/sndstat dump sndstat.h:160. Currently not exploitable: every mutation path holds CHN_LOCK+PCM_BUSY (feeder_chain CHN_LOCKASSERT feeder_chain.c:575; dsp ioctls PCM_ACQUIRE_QUICK dsp.c:1434; pcm_chn_destroy PCM_BUSYASSERT sound.c:605); sndstat reader also takes PCM_ACQUIRE_QUICK sndstat.c:401 serializes. Silent fragility: future reader outside PCM_BUSY protocol would deref freed M_FEEDER heap. Fix: if(c->feeder!=NULL)c->feeder->parent=NULL before feeder_destroy.