# DF-5511 -- ppb_release_bus() ctx-save race: context snapshotted after owner clear

## What
ppbconf.c:528 clears ppb_owner, then :532 reads ppb_get_mode() into ppbdev->ctx.mode outside any crit section; a competing child acquiring the bus in the window gets its mode saved into the wrong device's context, which ppb_request_bus():491-492 later restores.

## Build / run / expected (inside the DragonFly guest)
```
build (guest): sh build.sh
run   (guest): sh run.sh   # F2 phase runs 10 s
expected pristine: "DF-5511 releaser iterations=50000000 ... WRONG-mode-captured(B's EPP in A's ctx)=N -> REPRODUCED" (N = 2/1/1/6 across runs)
expected patched : "... WRONG-mode-captured ... =0 -> race not hit this run"
```

## Rig
`ppbharness2.ko` compiles the VERBATIM production sources
/usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc"
controller on nexus provides a fully scripted (malicious) IEEE1284 peer.
Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical
copies here).