bce_nvram_read returns on first-dword read failure while still holding the NVRAM arbitration lock and access-enable, permanently bricking NVRAM access (driver re-attach fails)

Summary

In the unaligned-offset prologue of bce_nvram_read(), a timeout from bce_nvram_read_dword() returns immediately instead of jumping to the locked_exit, leaving bce_acquire_nvram_lock() and bce_enable_nvram_access() in force. Every later bce_acquire_nvram_lock then spins out to EBUSY, so a subsequent attach's bce_nvram_test fails and the device cannot re-attach after kldunload/kldload until power cycle. The code's own 'XXX should we release nvram lock if read_dword() fails?' comment marks the spot. Only reachable via an NVRAM read timeout (hardware fault) at attach; no attacker-controlled trigger. Verification skipped per contract (Low).