DF-5521 fix validation session (patched iicbus.ko / iicsmb.ko / smb.ko +
kernel rebuilt: smbus is compiled into X86_64_GENERIC)
======================================================================

[fixed chain up on rebuilt kernel (#1 Tue Oct 6 22:05:46 UTC 2026)]
# kldload iicbus && kldload iicsmb && kldload smb && kldload /root/df5521_rig.ko
# ls -l /dev/smb0
crw-------  1 root  wheel  32, 0x00000000 Oct  6 22:11 /dev/smb0

[racefixed: child loops SMB_BREAD (300ms in-flight), parent unloads]
poc: child 828 looping BREAD; waiting 1s
poc: >>> kldunload iicsmb mid-BREAD (expect EBUSY) <<<
unloading iicsmb.ko
kldunload: can't unload file: Device busy          <-- guard fired
poc: child still alive? yes (in-flight ioctls completing normally)
poc: >>> kldunload iicsmb after client stopped (expect success) <<<
unloading iicsmb.ko
rc=0                                              <-- clean unload
poc: firing INTR_STOP via iicbus_intr after clean unload (owner must be NULL now)
hw.dfa.fire_event: 0 -> 0
poc: fire rc=0
poc: racefixed done -- GUEST ALIVE, fix validated
===ALIVE===
 7    1 0xffffffff82638000     1000 df5521_rig.ko   (iicsmb gone, no crash)

RESULT: baseline panic (freed-module-text execution) is GONE with the fix;
unload is refused while a transaction is in flight and succeeds cleanly
once quiesced; a post-unload iicbus_intr is a no-op instead of a
dangling-owner dispatch.