UAF race in gpio_acpi_unmap_aei: deferred AEI event handler dereferences freed info struct

Summary

When GPIO AEI interrupt fires gpio_acpi_aei_handler queues gpio_acpi_handle_event(arg) via AcpiOsExecute(OSL_GPE_HANDLER) passing raw pointer into sc->infos array. During detach gpio_acpi_unmap_aei calls GPIO_TEARDOWN_INTR which stops NEW interrupts but does NOT drain already-queued AcpiOsExecute work items. Then memset-zeros info struct and kfree entire infos array. A queued work item running after kfree invokes gpio_acpi_handle_event on freed memory reading info->dev from freed/zeroed slab - UAF that in common case is NULL-deref kernel panic. Comment XXX Wait until ACPI Event handler has finished acknowledges gap. Requires root + GPIO interrupt in race window.