=== BUGGY (stock mfip_detach, mfi_cam.c:142-159) ===
attached: sim refcount=2 devq refcount=1
pre-detach: queued=3 free_cmds=0
post-detach: sim freed=1 bus sim=dead_sim queued-nonempty=YES mfi_cam_start=STALE (mfip_start)
V1 VIOLATED: 3 ccb(s) leaked in mfi_cam_ccbq (never xpt_done; no XPT_ABORT support -> unrecoverable hang + leak)
V2 VIOLATED: mfi_cam_start still set after sim freed
simulating post-mfip_detach disk completion -> mfi_startio
    [xpt_done] UAF: ccb 1 completed after its periph was destroyed (dispatch sim=0x4025c0 dead_sim)
simulating kldunload (module text unmapped) + one more mfi_startio
    [mfip_start] UAF: call into unmapped module text after kldunload
BUGGY: 4 violation(s)
exit=1

=== FIXED (drain mfi_cam_ccbq + clear mfi_cam_start) ===
attached: sim refcount=2 devq refcount=1
pre-detach: queued=3 free_cmds=0
post-detach: sim freed=1 bus sim=dead_sim queued-nonempty=no mfi_cam_start=NULL
simulating post-mfip_detach disk completion -> mfi_startio
FIXED: 0 violation(s)
exit=0
double-run-exit=0