# DF-4719 — aac_cam: pending AAC_EVENT_CMFREE fires after aac_cam_detach freed the sim → xpt_release_simq/xpt_done on freed objects

## Root cause (code trace; hw-gated — no AAC adapter in the QEMU guest)

When `aac_alloc_command()` fails, `aac_cam_action()` freezes the simq and
queues an `AAC_EVENT_CMFREE` holding the ccb (with `sim_priv[0].ptr =
camsc`) (`sys/dev/raid/aac/aac_cam.c:395-407`). The event fires from
`aac_release_command()` (`sys/dev/raid/aac/aac.c:1416-1420`) whenever a
command returns to the pool, and `aac_cam_event()` then calls
`xpt_release_simq(camsc->sim, 1)` and `xpt_done(ccb)`
(`aac_cam.c:165-172`).

`aac_cam_detach()` (`:191-213`) frees `camsc->sim` via `cam_sim_free()`
without cancelling pending CMFREE events (the frozen ccb is not queued in
CAM at all — CAM cannot see it). If the adapter is detached while a CMFREE
event is pending (FIB pool exhausted + device detach), the next command
release fires the event and dereferences the freed `sim` (and freed
`camsc` softc) → use-after-free write inside CAM.

Reachability: root-initiated detach (or driver shutdown) while the FIB
pool is exhausted and a ccb waits on the event queue — narrow, but the
leak of the pending event is structural (nothing ever removes it).
Speculative/likely by trace; not runtime-verified (no AAC hardware).

## Fix

Cancel the pending events for this sim in `aac_cam_detach()` before
freeing it — `fix.diff` (completes the stranded ccbs with
CAM_REQ_ABORTED after releasing the simq).