atmel_mxtread/write/kqfilter dereference softc without the NULL guard used by open/close/ioctl — NULL-deref (later UAF) via fd held across driver detach/kldunload

Summary

open/close/ioctl validate ATMEL_SOFTC(minor) against NULL; read, write and kqfilter use it unconditionally. detach never waits for or invalidates open descriptors - an fd held across kldunload leaves the surviving cdev pointing at a NULL/freed devclass slot; the next read/write/kqfilter hits lockmgr on NULL or freed memory. Node is 0600 root:wheel, so ceiling is privileged self-DoS. NULL-guard + EBUSY fix.