arcmsr_detach() tears down DMA pool and cdev before deregistering the CAM SIM; MSIX IRQ resources leaked

Summary

arcmsr_detach() calls arcmsr_free_resource() - which destroys the ioctl cdev, unloads/destroys the srb_dmamap and frees the SRB pool mapping - BEFORE xpt_bus_deregister()/cam_sim_free(). Any CCB still owned by CAM/SIM at detach time completes through paths that touch the freed pool and the per-SRB ccb_callouts, a use-after-free on module unload under I/O. Additionally arcmsr_teardown_intr() leaves the MSIX irqres[] unreleased (the bus_release_resource calls are commented out), leaking the IRQ resource per detach/attach cycle. Module unload requires root, hence Low. Verification skipped per contract (Low, hardware-gated).