DF-5521 baseline session (stock modules) — decisive excerpts
============================================================

[chain up]
# kldload iicbus; kldload iicsmb; kldload smb; kldload /root/df5521_rig.ko
df5521: added dfa_iic0, probing+attaching
dfa_iic0: <df5521 software I2C controller (wire-logged)> on isa1
iicbus0: <Philips I2C bus> on dfa_iic0
iicsmb0: <SMBus over I2C bridge> on iicbus0
smbus0: <System Management Bus> on iicsmb0
smb0: <SMBus generic I/O> on smbus0
# ls -l /dev/smb0
crw-------  1 root  wheel  32, 0x00000000 Oct  6 21:38 /dev/smb0
# kldstat | grep -E "iic|smb|df5521"
 4    3 0xffffffff82600000    1f000 iicbus.ko
 5    1 0xffffffff8261f000     e000 iicsmb.ko
 6    1 0xffffffff8262d000    10000 smb.ko
 7    1 0xffffffff8263d000     1000 df5521_rig.ko

[race: child loops SMB_BREAD, each held in-flight 300ms via hw.dfa.rdelay;
 the uninitialized-bcount variance is visible: req_len=255 in the forked
 child vs req_len=0 in the parent's proto run — see DF-5523]
df5521-wire: READ req_len=255  <== bridge *count
df5521-wire: READ gave 255 bytes: 08 a0 a1 a2 ...
df5521-wire: STOP
...
df5521-wire: READ req_len=255  <== bridge *count

[parent: kldunload iicsmb while child mid-BREAD]
poc: >>> kldunload iicsmb while child mid-BREAD <<<
poc: kldunload rc=0 (panic expected on/after this)
smb0: detached
smbus0: detached
iicsmb0: detached
df5521-wire: READ gave 255 bytes: 08 a0 a1 a2 ...

Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xffffffff8261f0bf
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0xffffffff8261f0bf
current process	= 989
kernel: type 12 trap, code=10
CPU4 stopping CPUs: 0x0000002f
Stopped at      iicbus_devclass+0x1e3e7:

Fatal trap 12: page fault while in kernel mode   (double fault while printing)
fault virtual address	= 0xffffffff8261f0bf
fault code		= supervisor read data, page not present
db>

NOTE: 0xffffffff8261f0bf is inside the unloaded iicsmb.ko text
      (0xffffffff8261f000 + 0xe000, per kldstat above) — the sleeper
      resumed execution in freed module text.

[second crash mode observed during fix development — same race,
 teardown reached via the smbus/iicsmb driver-module registration
 (iicsmb.c:510) which force-detaches smbus0 without calling
 iicsmb_detach; woken sleeper then called smbus_release_bus() on the
 freed smbus0 device:]
smb0: detached
smbus0: detached
df5521-wire: READ gave 8 bytes: a0 a1 a2 a3 ...
df5521-wire: STOP
Fatal user address access from kernel mode from df5521_poc at ffffffff805d8278
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x0
Stopped at      smbus_release_bus+0x78: cmpq    %r13,(%r12)
db>