fd_detach stops only two of fd three callouts leaving fd_iotimeout armed over freed softc

Summary

fd_detach() calls callout_stop on fd->toffhandle and fd->motor but never on fd->tohandle even though tohandle armed during I/O as fd_iotimeout watchdog (callout_reset at :1970 :1980). If fd driver detached while I/O in flight with pending tohandle callout structure (embedded in fd softc) and controllers fdc->fd back-pointer can outlive softc leading to UAF when watchdog fires. callout_stop does not wait for concurrently-executing instance so race between detach and firing watchdog possible. Requires privilege to unload/detach plus I/O in progress.