Fire-and-forget AcpiOsExecute battery tasks can run after detach using freed softc (UAF)

Summary

acpi_cmbat queues callbacks via AcpiOsExecute carrying raw device_t. AcpiOsExecute purely asynchronous (lwkt_sendmsg) and acpi_cmbat_detach never drains pending tasks so queued acpi_cmbat_get_bif_task/acpi_cmbat_init_battery can execute after softc torn down reading/writing freed memory. attach/resume/notify handler all call AcpiOsExecute(...cb dev). OSL stores pointer verbatim helper thread later invokes cb(dev) with no lifecycle tie. detach only does AcpiRemoveNotifyHandler + acpi_battery_remove returns; does not wait/cancel queued messages. get_bif_task no attachment re-check. init_battery partial guard device_is_attached runs AFTER device_get_softc deref. Trigger: firmware notifies (dock hot-plug) or root ACPI debug path + module unload/dock hot-removal.