DF-5544 fix validation — PATCHED kernel #1 (fix.diff applied via
/usr/src patch + make quickkernel + make installkernel, rebooted).
Guest otherwise identical (same QEMU UHCI device, same veto.ko build).

R1 — identical trigger, veto child active (baseline comparison point):

  # kldload /root/df5544/veto.ko && sysctl hw.df5544=1
  veto0: DETACH VETO: returning EBUSY -- watch uhci_pci_detach swallow this and tear down anyway
  uhci0: child device failed to detach (16); refusing controller teardown   <-- THE FIX
  DF5544: device_detach(uhci0) returned 16 -- honest failure
  DF5544: post: uhci0 driver=uhci state=3               <-- DS_ATTACHED, driver still bound
  DF5544: uhci0 STILL has 1 child device(s): veto0(attached=1)

  # sysctl hw.df5544=2                                   <-- same touch that panicked the baseline
  DF5544: post-teardown softc: pframes_pc.buffer=0xfffff8008df7b000 (was 0xfffff8008df7b000),
  qh buffer=0xfffff8008df7c000 (was 0xfffff8008df7c000)  <-- DMA memory INTACT, no fault, guest alive

R2 — the retry path (child now cooperates, hw.df5544=5 then =1):

  veto0: post-teardown detach (parent orphaned): cooperating
  veto0: detached
  uhci0: detached
  DF5544: device_detach(uhci0) returned 0
  DF5544: post: uhci0 driver=(none) state=0
  DF5544: uhci0 STILL has 0 child device(s):             <-- honest success: no children left
  GUEST_STILL_ALIVE  (uptime confirms)

(The harness kprintf "...(the lie)" string in R2 is a stale label; the
decisive datum there is "0 child device(s)" — a clean, complete detach.)

Baseline vs patched, same trigger:
  baseline: return 0 + "uhci0: detached" + orphan attached child +
            IRQ/IO/DMA freed + softc kfreed -> Fatal trap 12 (panic.txt)
  patched : return 16 + teardown refused + driver bound + DMA intact +
            guest alive; retry after child cooperates completes cleanly.

Full serial console of the patched run: fix_serial_console_full.log