--- /home/maxx/dfbsd/dfbsd/sys/dev/raid/aac/aac.c	2026-07-22 16:41:59.460308436 +0000
+++ /tmp/opencode/fix/aac.c	2026-09-16 10:59:46.452872293 +0000
@@ -680,7 +680,15 @@
 		error = device_delete_child(dev, co->co_disk);
 		if (error)
 			return (error);
+		/*
+		 * aac_handle_aif() and aac_query_disk() traverse this list
+		 * under aac_container_lock (the former during its removal
+		 * phase); detach must use the same lock or it races an
+		 * in-flight AIF re-enumeration into a use-after-free.
+		 */
+		lockmgr(&sc->aac_container_lock, LK_EXCLUSIVE);
 		TAILQ_REMOVE(&sc->aac_container_tqh, co, co_link);
+		lockmgr(&sc->aac_container_lock, LK_RELEASE);
 		kfree(co, M_AACBUF);
 	}