Detach does not drain AcpiOsExecute callbacks: stale softc use-after-free (latent, AcpiOsWaitEventsComplete is no-op stub)

Summary

acpi_cmbat_attach L154/resume L174/notify L202 queue async AcpiOsExecute(acpi_cmbat_init_battery/get_bif_task,dev) running up to ~60s in taskq. acpi_cmbat_init_battery captures sc=device_get_softc(dev) ONCE L450 BEFORE retry loop sleeps AcpiOsSleep(10000) L459 holding stale sc. device_is_attached(dev) check L461 outside any lock TOCTOU. acpi_cmbat_detach L159-168 does NOT drain callbacks; AcpiOsWaitEventsComplete() is empty stub acdragonfly.h:218-220 XXX TBI. Root kldunload acpi_cmbat or physical battery hot-unplug _BIF_CHANGE notify before detach. Stale-pointer deref in taskq -> kernel panic. Unprivileged local has no path. Same pattern acpi_smbat.c no detach. Fix: per-softc dying flag set under cmbat serial lock in detach; re-check inside lock in init_battery; implement AcpiOsWaitEventsComplete for real.