# DF-2381 - fujitsu deferred notify on freed softc: KERNEL PANIC

## Rig (ACHARNESS + ssdt_acsim FJS0, op=run_fufreed)
1. blocker queued on the real acpi_task thread (30s tsleep)
2. eval \_SB.NFJ -> Notify(FJS0, 0x80); ACPICA queues notify-dispatch
   behind the blocker
3. softc freed exactly as device_set_driver() at detach:
   kfree(0xfffff8008bb47d10 [208 bytes], M_BUS) + softc=NULL + 0x41 spray
4. blocker times out -> dispatch -> acpi_fujitsu_notify_handler queues
   acpi_fujitsu_notify_status_changed(sc) -> acpi_fujitsu_update ->
   acpi_device_get_parent_softc(sc->dev) with sc->dev = 0x4141...

## Result (panic.txt)
Fatal trap 12: page fault, fault virtual address = 0x28
Stopped at device_get_parent: movq 0x28(%rdi),%rax
current process = Idle

## Fix (fix.diff = real AcpiOsWaitEventsComplete drain in OsdSchedule.c)
AcpiRemoveNotifyHandler (acpi_fujitsu_detach) now drains queued tasks
before the softc is freed. Compile-validated in the fixed ACHARNESS build;
the rig choreography frees the softc directly (bypassing the
AcpiRemoveNotifyHandler call site) so the rig cannot itself demonstrate
the fix - the production detach path is what the fix protects.