Use-after-free of softc in acpi_hp_notify vs. acpi_hp_detach (DF-2381 AcpiOsWaitEventsComplete no-op)

Summary

acpi_hp_notify dispatched by acpi_wmi_notify_handler AFTER releasing acpi_wmi serial lock and does not take hp serial lock. acpi_hp_detach calls ACPI_WMI_REMOVE_EVENT_HANDLER then immediately tears down softc but AcpiOsWaitEventsComplete is empty no-op so AcpiRemoveNotifyHandler does not drain in-flight handler invocations. Notify running on another CPU can dereference freed softc. Same DF-2381 family root cause (acdragonfly.h:219-220 no-op). ACPI_WMI_REMOVE_EVENT_HANDLER only NULLs winfo->event_handler under lock neither waits for nor prevents concurrent dispatch that already snapshotted handler/handler_data. Local attacker with kldunload privilege racing against incoming ACPI WMI hotkey event.