# DF-1097 — UAF/double-free in fwohci_pci_add_child error path

## Claim
`fwohci_pci_add_child()` at `sys/bus/firewire/fwohci_pci.c:442-447`:
```c
err = device_probe_and_attach(child);
if (err) {
    device_printf(parent, "probe_and_attach failed with err=%d\n", err);
    fwohci_pci_detach(parent);          /* line 446 */
    device_delete_child(parent, child); /* line 447 — child already freed */
    return NULL;
}
```
`sc->fc.bdev` is set to `child` at line 439. `fwohci_pci_detach(parent)`
enters its body at fwohci_pci.c:342, and at lines 351-354 calls
`device_delete_child(self, sc->fc.bdev)`. `device_delete_child` at
`sys/kern/subr_bus.c:1284-1309` ends with `kobj_delete((kobj_t)child, M_BUS)`
at subr_bus.c:1306 → **child is kfree()'d**. It also `TAILQ_REMOVE`'s
child from `dev->children` (subr_bus.c:1304) and `bus_data_devices`
(subr_bus.c:1305).

Then control returns to `fwohci_pci_add_child` line 447, which calls
`device_delete_child(parent, child)` on the now-freed pointer:
- `device_detach(child)` reads `child->state` (UAF read)
- `TAILQ_FIRST(&child->children)` dereferences freed memory (UAF read)
- `child->devclass` (UAF read)
- `TAILQ_REMOVE(&dev->children, child, link)` corrupts the parent's
  children list (the link was already removed) — **use-after-free with list
  corruption**.
- `kobj_delete((kobj_t)child, M_BUS)` at subr_bus.c:1306 — **double-free**.

## Trigger
Reachable only when `device_probe_and_attach(child)` fails inside
`fwohci_pci_add_child`. The firewire (fwohci) driver invokes
`fwohci_pci_add_child` as its `bus_add_child` method during attach
(fwohci_pci.c:473). On production hardware the firewire child always probes
and attaches successfully, so the error path is never exercised. Realistic
triggers:
1. Memory pressure during newbus allocation in the child's attach path.
2. A malicious/buggy FireWire OHCI PCI controller that probes but fails to
   attach (hot-plug via Thunderbolt/ExpressCard/PCIe).

## Reproducibility on this guest
The default audit guest has **no FireWire OHCI PCI device** (QEMU ships no
FW-OHCI device model). `pciconf -lv` shows no FireWire class (0x0c00) device
and `dmesg | grep -i fwohci` is empty. The driver is compiled into the
GENERIC kernel but never attaches, so `fwohci_pci_add_child` is never even
called. The bug is **latent** — confirmed by source trace but not
runtime-triggerable on this guest.

A realistic runtime trigger would require either a physical FireWire PCI
card or a QEMU patch adding an FW-OHCI device model. Neither is available
in the audit environment. See `VERDICT.md` for the full source-level trace.

## Fix
`fix.diff`: clear `sc->fc.bdev` before calling `fwohci_pci_detach` so the
detach's `device_delete_child(self, sc->fc.bdev)` is a no-op, leaving the
explicit `device_delete_child(parent, child)` at line 447 as the sole
delete.