== DF-2396 staging attempt (ACHARNESS #3) ==
The reader-vs-detach race requires live aibs sensor OIDs; the verbatim
aibs attach wedged the harness guest (see DF-2395) so no race window was
exercised.
== framework analysis (source, this tree) ==
sys/kern/kern_sysctl.c:391:  while (oidp->oid_running > 0) {
sys/kern/kern_sysctl.c:393:      tsleep_interlock(&oidp->oid_running, 0);
sys/kern/kern_sysctl.c:395:      tsleep(&oidp->oid_running, PINTERLOCKED, "oidrm", 0);
grep -rn "oid_running" sys/kern/ sys/sys/  -> READ-ONLY: no increment site
exists anywhere in the kernel; sysctl_root calls oid->oid_handler with no
running marker. The drain loop is dead code.
aibs side: aibs_detach sensordev_deinstall + kfree(sc_asens_*) at
atk0110.c:267-275 while per-sensor oid arg1 pointers reference the arrays.