Summary

dsp_clone validates under PCM_LOCK and only then does PCM_WAIT/ACQUIRE. A thread parked in PCM_WAIT holds no SD_F_BUSY, so pcm_unregister runs to completion concurrently: REGISTERED cleared, clones destroyed and NULLed, lock freed, cv destroyed. The broadcast wakes the parked dsp_clone which then calls snd_clone_alloc(NULL) (NULL-deref) or at minimum PCM_RELEASE_QUICK on the freed lock. Requires root detach racing an unprivileged open. Re-validate-after-wake fix.