# DF-5512 -- ppbus_setup_intr() overlapping registrations corrupt forced-teardown bookkeeping

## What
ppbconf.c:426-427 unconditionally overwrite ppbdev->intr_cookie/intr_resource; a second registration (reachable via lpt.c write-error paths that keep the bus) orphans the first handler -- ppb_release_bus():514-521 can then only tear down the last one.

## Build / run / expected (inside the DragonFly guest)
```
build (guest): sh build.sh
run   (guest): sh run.sh   # deterministic F3 section
expected pristine: "setup#2 err=0 ck2=0x1001 ivars.cookie=0x1001" then "after ppb_release_bus: parent setups=2 teardowns=1 still-live=1 ... REPRODUCED"
expected patched : "setup#2 err=16 (EBUSY) ... still-live=0"
```

## Rig
`ppbharness2.ko` compiles the VERBATIM production sources
/usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc"
controller on nexus provides a fully scripted (malicious) IEEE1284 peer.
Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical
copies here).