xa_strategy / xa_size dereference sc without lifetime lock racing xa_terminate_check free

Summary

Both xa_strategy and xa_size dereference sc=dev->si_drv1 without taking xdisk_lk. xa_terminate_check (run under xdisk_lk) frees sc at :680 and NULLs si_drv1 at :665. xa_size NULL-checks but then dereferences sc->info.d_media_blocks without lock classic check/use TOCTOU. xa_strategy reads si_drv1 at :801 immediately dereferences sc->stats at :805 with neither NULL check nor lock. disk_destroy synchronous so strategy path largely drained before si_drv1 NULLed making trigger narrow but xa_size has no such protection.