Summary

disable_irq() and enable_irq() walk module-global irq_list with SLIST_FOREACH and never acquire irqdata_lock; free_irq() does lookup the same unlocked way and only takes lock later purely for SLIST_REMOVE. bus_teardown_intr/bus_release_resource/pci_release_msi/kfree in free_irq all execute outside any lock. Two threads in free_irq() for same (irq,dev_id) or any disable_irq/enable_irq racing free_irq both resolve same still-linked irq_entry; first unlinks+kfrees second then dereferences freed memory and re-invokes bus teardown/release/SLIST_REMOVE/kfree -> UAF read double bus_teardown_intr double kfree guaranteed NULL-deref panic inside SLIST_REMOVE (queue.h:215-216 while walk runs off tail when elm already gone). Reachable: DRM_IOCTL_CONTROL DRM_UNINST_HANDLER (drm_irq.c:256-261->drm_irq_uninstall->free_irq at drm_irq.c:220) gated DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY and DRIVER_LEGACY; alternatively concurrent devctl detach of GPU or two DRM masters on legacy UMS. disable_irq/enable_irq zero in-tree callers. Impact: kernel mem corruption UAF+double-free on M_DRM slab primitive for LPE or immediate SLIST_REMOVE NULL-deref panic.