md_drvcleanup module-unload path has refcnt TOCTOU that frees md_s out from under a racing mdopen

Summary

On MOD_UNLOAD md_drvcleanup() does single unlocked atomic_fetchadd_int(&refcnt 0) read (:472) and if zero frees every md_s in mdlist (kfree(sc->secp) :492 kfree(sc) :493) without holding any lock mdopen/mdclose take. Concurrent mdopen() reads dev->si_drv1 then lwkt_gettoken(&sc->tok) (:133-134) and bumps refcnt (:137) can slip in between check and free dereferencing about-to-be-freed sc crashing/corrupting. dev->si_drv1 never NULLed before free. disk_destroy asynchronous so cdev and si_drv1 can still be referenced while sc freed.