# DF-4874 — afd_detach() in-flight teardown race (twin of reproduced DF-4797)

`sys/dev/disk/nata/atapi-fd.c` — `afd_detach()` (atapi-fd.c:134-156) frees the
`afd_softc` while `afd_strategy()`/`afd_done()` can still be running against it,
and while the shared disk layer (`disk_invalidate()`→`dsgone()`) frees
`dp->d_slice` out from under concurrent `diskstrategy()`/`dscheck()`.

This is the exact code shape of **DF-4797** (ata-disk.c), which was REPRODUCED
2/2 on this very guest (fatal trap 12 in `dscheck+0x48`) and fix-validated —
see `findings/poc/DF-4797/`. The afd driver is a byte-for-byte structural twin
(same `disk_invalidate` → `disk_destroy` → `ata_fail_requests` → `kfree`
ordering, same non-draining completion path via `taskqueue_swi_mp`).

## Status: untested (in-situ) — hard blocker: no ATAPI floppy hardware

* Guest kernel has the `afd` driver compiled in (`device afd`, config line
  `40 ata/afd`), but the afd driver only attaches to ATAPI *direct-access*
  devices (atapi-fd.c:90-91, `ATA_ATAPI_TYPE_DIRECT`).
* QEMU 7.2 (the audit guest's emulator) provides only `ide-hd` and `ide-cd`
  on the IDE bus — **no ATAPI direct-access (floppy/ZIP-class) emulation
  exists**, so no `afd0` device can ever exist on this guest:

```
$ qemu-system-x86_64 -device help | grep -i ide
name "ide-cd", bus IDE, desc "virtual IDE CD-ROM"
name "ide-hd", bus IDE, desc "virtual IDE disk"
```

* Recorded on the guest (run.log): the DF-4797-style detach trigger built and
  loaded cleanly against the `afd` devclass, and reported
  `df4874: afd0 device_t is NULL` — devclass present, zero devices.
* The shared-code race this finding rides on (subr_disk.c `dscheck` vs
  `dsgone`) is the *identical* mechanism DF-4797 reproduced on `ad0` in situ.

## Reproduce (on hardware/VM that has an ATAPI floppy)

```
# on the audit guest (build):        ./build.sh
# on a system with a real afd0:      ./run.sh
./df4874_storm 16 25 &               # 16 threads raw-pread /dev/afd0
sysctl kern.df4874.cycles=4
sysctl kern.df4874.ms=300
sysctl kern.df4874.run=1             # device_detach(afd0) cycles
```

Expected baseline (bug present): fatal trap 12 in `dscheck+0x48` (disk-layer
race, fault address 0xc — same as DF-4797 run 1/2), or a NULL/UAF write in
`afd_done()` (`devstat_end_transaction_buf(&fdp->stats)` with `fdp == NULL`,
atapi-fd.c:321/329).