Global modules TAILQ mutated without mod_token: unpriv readers race with privileged kldload/unload

Summary

module_register(:141) and module_release(:178) mutate modules TAILQ under kld_lock/llf_lock. sys_mod*(readers) traverse same list under mod_token(:253,:289,:328,:385). Lock domains are disjoint -> unpriv modstat loop concurrent with privileged kldload/unload corrupts TAILQ pointers -> panic/UAF.