DF2477: racing mdopen rc=0 refcnt=1 (open SUCCEEDED against an sc that was then freed)
DF2477: dev->si_drv1 was NEVER set to NULL after drvcleanup; read through the dangling pointer after reclaim: sc->unit=0xc7c7c7c7 sc->nsect=0xc7c7c7c7 (reclaimed marker 0xC7)
DF2477: RESULT=UAF CONFIRMED (freed md_s reclaimed by unrelated allocation; next mdopen/mdclose takes sc->tok on freed memory)
DF2477: log: mdcreate_malloc(auto-create) [after open+close refcnt=0] disk_destroy mdcreate_malloc(auto-create) [racing mdopen rc=0 refcnt=1] devstat_remove
--- fixed source A/B ---
DF2477: log: ... destroy_dev(drain) [racing mdopen rc=0 refcnt=1]
    (log ENDS here: EBUSY returned, nothing freed, sc intact - reclaim read returns non-marker values)