Summary

amrd_strategy (amr_disk.c:179) stores bio_driver_info=sc no refcount; amrd_detach (276-292) calls disk_destroy without ensuring no bios in-flight on controller. amr_flush (amr.c:1073) only issues single AMR_CMD_FLUSH does NOT drain sc->amr_bioq or wait for dispatched amr_commands. After device_delete_child frees amrd_softc next amrd_intr (amr.c:1209 -> amr_disk.c:196) devstat_end_transaction_buf(&sc->amrd_stats) derefs freed memory. Author aware: #if 0 XXX swildner at 283 was a DISKFLAG_OPEN guard but DISKFLAG_OPEN undefined in DFly AND amrd_disk embedded struct not pointer so original -> form would not compile. Trigger: root kldunload amr / ACPI eject / AER while children have large aio_read in flight on /dev/amrd0. Impact: UAF panic A:H; heap grooming for code exec speculative. AV:L/AC:H/PR:H, A:H. Fix: si_refcount>0 gate in detach + drain amr_bioq/busyslots in amr_pci_shutdown before device_delete_child.