Use-after-free race between acpiioctl() hook dispatch and acpi_deregister_ioctl()

Summary

acpiioctl() captures pointer to registered ioctl hook (struct acpi_ioctl_hook *hp) while holding ACPI_LOCK(acpi) then releases ACPI_LOCK and invokes hp->fn(...) with only lwkt_token acpi_token held. acpi_deregister_ioctl() takes only ACPI_LOCK (not the token) removes hook from list and kfree()s hook struct. If deregister runs in window between acpiioctl ACPI_UNLOCK and hp->fn() call function pointer dereferenced through freed memory. lwkt_token does not help because deregister never acquires it. Requires kldunload of ACPI sub-driver during concurrent ioctl. Impact kernel UAF panic DoS or with heap grooming indirect call to attacker-chosen address.