FIX VALIDATION (kernel md5 54c1a462e7f1c6bc303929ac0cd99ac3, fix.diff v3)

fixrun3 (64 MB, del mid-write, re-add):
[+] stale fd 3 open on /dev/input/event4
[+] writer thread started (64 MB)
[writer] write(64 MB) returned 67108848 bytes     <- del landed after write end
[+] new fd 4 open on re-created /dev/input/event4
[.] closing stale fd 3 (evdev_dtor ...)           <- NO PANIC (v1/v2 panicked here)
UAF-NOT-CONFIRMED: total_events=0 magic_hits=0 writer_bytes=67108848 writer_err=0
RC=1

fixrun4 (256 MB, del 0.7 s after start = mid-write):
[writer] write failed: Bad file descriptor        <- devfs rejects detached cdev
UAF-NOT-CONFIRMED: total_events=0 magic_hits=0 writer_bytes=0 writer_err=9

fixrun5 (256 MB, mid-write):
[writer] write failed: Bad file descriptor
UAF-NOT-CONFIRMED: total_events=0 magic_hits=0 writer_bytes=0 writer_err=9

fixstress (256 MB write + 6x device_del/device_add churn — the exact
          schedule that hard-wedged the baseline kernel):
[writer] write failed: Operation not supported by device   <- ENODEV at revoke
[+] new fd 4 open on re-created /dev/input/event4
[.] closing stale fd 3 (evdev_dtor ...)
UAF-NOT-CONFIRMED: total_events=0 magic_hits=0 writer_bytes=0 writer_err=19
RC=1
vm.sh status => up throughout; /dev/input back to event0..event4.

functional smoke (patched kernel): reader on event4 while QEMU sendkey a/b:
00000000  ee c4 af 6a 00 00 00 00  2a 91 0c 00 00 00 00 00
00000010  01 00 1e 00 01 00 00 00   <- {EV_KEY, KEY_A, 1} down
...       01 00 1e 00 00 00 00 00   <- {EV_KEY, KEY_A, 0} up
=> normal event delivery unregressed.

BASELINE for comparison (pre-fix runs, see run.log): 19/5/2 magic events
per round; 64 MB write full-success through the dangling pointer; the
6-cycle churn wedged the guest (ssh dead, serial silent, 394 %CPU).