Missing AcpiRemoveNotifyHandler in acpi_dock_detach causes UAF / NULL-deref panic on ACPI notify after detach

Summary

acpi_dock_attach() registers global ACPI notify handler with AcpiInstallNotifyHandler(h ACPI_ALL_NOTIFY acpi_dock_notify_handler dev) at :518 but acpi_dock_detach() (:524-533) never removes it. After detach returns newbus frees softc and sets dev->softc=NULL. Any subsequent ACPI notification on dock handle (hardware dock/undock event _LCK/_EJ-driven re-eval) redispatches acpi_dock_notify_handler with stale dev dereferences freed/NULL softc. Two failure modes: (1) Race window between kfree and =NULL notify on ACPI task thread writes sc->_sta through freed pointer genuine UAF write (2) After detach dev->softc NULL device_get_softc returns NULL sc->_sta write dereferences NULL guaranteed panic. Every sibling driver removes handler in detach; acpi_dock lone exception.