dsp: Fix a potential use-after-free in dsp_oss_syncstart()

This function has a loop where it attempts to lock all channels in a
group.  If doing so would block, it releases all locks, sleeps for a
bit, and tries again.  However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again.  I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels.  Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Approved by:	so
Security:	FreeBSD-SA-26:58.sound
Security:	CVE-2026-58091
Reported by:	Hazley Samsudin of GovTech CSG
Reviewed by:	christos
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58912

0 files changed, 0 insertions, 0 deletions