DF-2311 iicread() bus-ownership leak (BUSAUDIT kernel, same rig;
hw.fakebb3.busowner sysctl reads struct iicbus_softc->owner, iicbus.h:39)
====================================================================
# ./poc2311   (v3: the probe is the read-only sysctl -- any further iic
               ioctl would itself request+release the bus and mask the
               leak; observed live during development)
DF2311: sc_addr=0x6d armed, sc->started kept nonzero
DF2311: iicbus0 owner BEFORE: 0 (0 = released)
DF2311: read() returned -1 errno=22 (block_read failed; iicread returned at
        iic.c:265-268 WITHOUT iicbus_release_bus)
DF2311: iicbus0 owner AFTER FAILED READ: 0xfffff8008bb654a0 (nonzero = LEAKED)
DF2311: iicbus0 owner +2s:                0xfffff8008bb654a0 (unchanged =
        permanent; any other iicbus child is locked out until reboot)
DF2311: REPRODUCED -- iicread() leaked the I2C bus ownership on block_read
        failure

TRIGGER NOTE: on the emulated peer a read-direction NACK cannot be
expressed (the slave only NACKs write-direction data bytes), so the
deterministic block_read failure used is iicbus_start's EINVAL
bus-already-started error (iiconf.c:178) -- the IDENTICAL early-error
return at iic.c:265-268 that the finding's NACKed-address flavor takes on
real hardware.  iicwrite()'s counterpart always releases (iic.c:225).