Unlocked vn_softc state in vnstrategy/vnget races vnclear -> NULL deref or UAF

Summary

struct vn_softc has no lock whatsoever. vnstrategy and vnget read vn->sc_vp/vn->sc_object after only unlocked peek at VNF_INITED. vnclear invoked from VNIOCDETACH and MOD_UNLOAD clears VNF_INITED calls vn_close/vm_pager_deallocate then NULLs pointers. Concurrent strategy call observes stale non-NULL pointer being freed or re-reads sc_vp as NULL dereferences in vn_lock/VOP_GETATTR kernel panic or UAF on recycled vnode. No serialization between paths. disk_getopencount unlocked read opencount>1 gate racy. VNIOCDETACH needs SYSCAP_RESTRICTEDROOT strategy needs operator-group open 0640. Privileged-cooperator local DoS.