Use-after-free race: unprivileged bktr ioctls race privileged msp_detach and write into the freed msp3400c struct (no locking, admitted by 'XXX mutex lock required')

Summary

msp_detach frees client->msp3400c_info with no lock while msp_wake_thread - reached on every TVTUNER_SETCHNL/SETFREQ/SAUDIO ioctl from unpriv /dev/bktrN - re-reads the pointer, calls setvolume from freed state, writes watch_stereo/restart flags into freed memory, and wakeup()s the freed struct's kthread pointer. The code itself notes 'XXX mutex lock required' and the driver is documented not mp-safe. Free side needs a privileged kldunload/hot-unplug, hence Low. lockmgr-serialization fix.