== DF-2393 in-flight choreography (ACHARNESS #3, three attempts) ==
ACSIM: eval \_SB.TMD1 -> status 0x0 (ok)
ACSIM: eval \_SB.NTF1 -> status 0x0 (ok)
ACSIM-NOTE: DF-2393: TMD1; NTF (GHCI sleeps 2500ms); free toshiba softc in-flight; expect trap on resume
ACSIM: free_softc: acpi_toshiba:0 softc=0xfffff8004f121d88 size=48 -> kfree(M_BUS)+NULL
ACSIM-NOTE: DF-2393: softc freed+canaried mid-_HCI; GHCI returns at t+2.5s -> hci_key_action derefs sc->video_handle
ACSIM-NOTE: DF-2393: no trap after 20s (unexpected)
attempt 2: manual respray poison:48:64 + poison:96:64 during the window -> no trap
attempt 3: fresh boot, arm+notify+free with correct 48-byte zone spray -> no trap
VERDICT: window demonstrated (handler ran on freed softc) but the resuming
ACPICA allocations recycle the chunk into mapped pointers -> graceful failure;
no fault. Same missing-drain root as DF-2381 (which panicked).