UAF: sysctl sensor read races kfree of sensor arrays in detach

Summary

aibs_detach calls sensordev_deinstall then immediately kfrees sc->sc_asens_{volt temp fan}. Per-sensor sysctl OIDs were created with arg1=sens (struct ksensor* into sc->sc_asens_*). sysctl framework SUPPOSED to drain in-flight handlers via oid_running loop at kern_sysctl.c:391-398 BUT oid_running NEVER incremented anywhere in kernel (grep confirms no write site). Additionally sysctl_find_oid walks OID tree lockless SLIST_FOREACH. Window: reader obtains raw oid pointer -> detach frees OID struct and sensor arrays -> reader dereferences freed oid->oid_lock and freed ks->desc via memcpy(us->desc ks->desc 32). Systemic framework issue affecting ALL sensor drivers freeing sensor storage in detach. Unprivileged user reads sensors world-readable racing root kldunload or VM host ACPI hot-unplug.