Summary

sio_pccard_detach() sets com->gone=1 and tears down IRQ/IO resources and ibuf but never calls callout_stop()/callout_drain() on com->dtr_ch and com->busy_ch. Both callouts carry raw pointer to com as callback arg and neither handler checks com->gone. Immediately after this function returns device_detach() (subr_bus.c:2150) frees softc via kfree. If either callout armed at detach time -- guaranteed for 3-second (dtr_wait=3*hz) window after every normal close -- pending callback fires on freed heap memory producing UAF write (com->state) and read (&com->dtr_wait). Callouts initialized in sioattach (sio.c:1033-1034) armed at runtime: comhardclose arms dtr_ch with timeout com->dtr_wait default 3*hz at sio.c:1526 whenever HUPCL/carrier-drop holds; siobusycheck self-re-arms every hz/100 at sio.c:1629 while CS_BUSY. Handlers siodtrwakeup (sio.c:1660-1669) and siobusycheck (sio.c:1604-1633) deref com fields WITHOUT gone guard. After detach device_set_driver(dev,NULL) kfrees dev->softc. Next callout tick operates on freed memory. Global comwakeup callout safe checks gone. Attacker: local user opens /dev/cuaa0 closes it (arming dtr_ch 3 sec) then card detached within window (physical removal root pccardc eject rogue card signaling removal). Impact: deterministic kernel UAF -- panic (local DoS); with slab grooming freed struct com_s (~700 bytes M_BUS kmalloc) reallocated with attacker-influenced data turns com->state write into controlled kernel-memory corruption potential code-exec. Gated on PCMCIA serial hardware present + trigger detach hence Medium despite high-impact bug class.