CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

A use-after-free vulnerability exists in the FreeBSD kernel's sound(4) driver, specifically in the SNDCTL_DSP_SYNCSTART ioctl implementation. The ioctl attempts to lock all channels in a sync group; if locking would block, it releases the sync group list lock and sleeps. Upon reawakening, the syn...