Use-after-free of softc in notify handler during detach (AcpiOsWaitEventsComplete is a no-op) DF-2381 class

Summary

acpi_toshiba_detach() removes notify handler and frees sysctl context without holding toshiba serial lock and AcpiOsWaitEventsComplete() is empty no-op (acdragonfly.h:218-220). AcpiRemoveNotifyHandler() returns immediately while in-flight acpi_toshiba_notify() still running on another CPU holding serial lock dereferencing softc. After detach returns newbus frees dev->softc still-running notify handler dereferences freed sc (sc->video_handle :498 sc->dev :531) -> UAF/panic. Same DF-2381 class. sysctl_ctx_free drains sysctl handlers via oid_running but no knowledge of notify handler. Attacker: root kldunload racing with concurrent ACPI 0x80 notify (Fn-key thermal/hotplug or injectable custom ACPI table).