pci_devq traversal in PCIOCGETCONF is unprotected: pci_token is single-taker races pci_freecfg (UAF)

Summary

PCIOCGETCONF acquires lwkt_token pci_token (line 332) and STAILQ-traverses global pci_devq dereferencing each pci_devinfo. But pci_token is declared static in this file (line 59) taken NOWHERE else in sys/ tree. Meanwhile pci_read_device() inserts into pci_devq and pci_freecfg() does STAILQ_REMOVE+kfree neither taking the token. pci_freecfg reachable from CardBus hot-plug. Token serializes nothing and concurrent device removal frees pci_devinfo that ioctl loop still dereferences - UAF. Loop dereferences dinfo->cfg.dev device_get_name() dinfo->conf fields copyout. CardBus eject/hot-unplug while root runs PCIOCGETCONF. Impact: kernel panic local DoS by already-privileged user.