Use-after-free on device disconnect: sc->data freed before /dev/videoX cdev is destroyed

Summary

uvc_drv_detach calls uvc_drv_destroy_data(sc->data) (freeing sc->data->fmt and sc->data) BEFORE uvc_v4l2_unreg(sc->video) (asynchronous destroy_dev). Several V4L2 ioctl handlers (VIDIOC_ENUM_FMT ENUM_FRAMESIZES ENUM_FRAMEINTERVALS G_FMT) read sc->video->data->fmt WITHOUT holding video->mtx. Concurrent ioctl issued while device being unplugged reads freed fmt buffer UAF. destroy_dev async (devfs_msg_send_dev) so /dev/videoX cdev remains live accepting ioctls until devfs thread processes destroy. Window extends until devfs async teardown. VIDIOC_ENUM_FMT reads kfreed memory yielding info leak or with heap grooming controlled read.