Use-after-free via un-drained discard_buffer_callout on device detach

Summary

tpm20_write arms 500ms discard_buffer_callout. tpm20_close does not stop it (no-op). tpm20_release frees sc->buf and uninits dev_lock WITHOUT draining discard_buffer_callout (only harvest_callout drained under #ifdef TPM_HARVEST). If detach occurs within 500ms of last write callout fires on freed memory: memset(sc->buf...) UAF write and lockmgr(&sc->dev_lock...) lock-use-after-destroy kernel panic or heap corruption. Attacker: root (device 0600 root:wheel). Trigger: write then kldunload/ACPI hot-remove within 500ms. Impact: kernel panic DoS. UAF write memset into freed slab could corrupt adjacent heap if reused within window.