Lockless list traversal in iconv_open/iconv_lookupcs/iconv_lookupconv allows use-after-free via concurrent module unload

Summary

Every reader of global iconv_cslist and iconv_converters TAILQ lists operates WITHOUT acquiring iconv_lock while every writer acquires LK_EXCLUSIVE on same lock. Because readers take no lock at all writers exclusive lock provides zero mutual exclusion. Thread in iconv_open can obtain pointer to cspair or converter class that concurrent module-unload or sysctl_add error-path thread is freeing then dereference freed memory UAF. iconv_lookupconv (lines 146-160) traverses iconv_converters bare TAILQ_FOREACH. iconv_lookupcs (lines 163-176) traverses iconv_cslist bare TAILQ_FOREACH. iconv_open calls both then dereferences returned pointers line 245 ICONV_CONVERTER_OPEN(csp->cp_dcp) line 264 dereferences dcp. Freeing paths: iconv_mod_unload:93-94 TAILQ_REMOVE+kfree(csp) line 224 iconv_unregister_converter:140-141 TAILQ_REMOVE+kobj_class_uninstantiate(dcp). iconv_sysctl_add:418 calls iconv_lookupconv BEFORE acquiring lock at 420 TOCTOU window. cp_refcount incremented/decremented without any lock in all 3 converters refcount-based safety check at iconv_mod_unload:87 itself racy. Freeing requires root kldunload. Reading side reachable from mount(2) on filesystems using iconv (msdosfs cd9660 smbfs ntfs udf). With vfs.usermount=1 unprivileged user can mount driving iconv_open. Impact: freed slab reclaimed with attacker data UAF into controlled kernel code execution.