Use-after-free in target teardown: fixed 500ms sleep before kfree(softc) does not drain in-flight CTIOs

Summary

targbhdtor() frees softc after fixed hz/2 sleep with no wakeup signaling while CTIOs dispatched by targbhstart() are neither tracked nor aborted by targbhdislun(). A CTIO still owned by the SIM when timeout expires completes into targbhdone(XPT_CONT_TARGET_IO) which dereferences freed softc (TAILQ_REMOVE on softc->pending_queue line 648 desc->data_resid write line 676) and freed periph. targbhdislun() only XPT_ABORTs idle accept_tio_list and immed_notify_slist - never aborts CTIOs dispatched to SIM. XXX comments at lines 342 and 419 acknowledge gap. Attacker as SCSI initiator can send INQUIRY then stall bus to keep CTIO pending beyond 500ms then trigger deregistration (bus reset camcontrol action hot-removal) to fire targbhdtor. Impact: kernel heap corruption groomable to arbitrary code execution minimally panic/DoS.