# DF-2396 - sysctl sensor race vs detach: NOT staged (rig wedge)

## Claim verification (source)
- kern_sysctl.c:391-398: `while (oidp->oid_running > 0) tsleep(...)`
- grep across sys/: oid_running is NEVER incremented - the drain is dead
  code; sysctl_root invokes oid->oid_handler with no running-marker.
- aibs_detach (atk0110.c:267-275) kfrees sc_asens_* immediately after
  sensordev_deinstall while per-sensor oid arg1 pointers reference them.

## Runtime
The race staging required a live aibs sensor device; the verbatim-attach
interposition wedged the harness guest (DF-2395 pack), so no race window
was actually exercised.

## fix.diff (compile-validated): atomic oid_running++/-- + wakeup around
the handler invocation in sysctl_root, making the existing drain loop
functional.