adw_idle_cmd_send: single RISC command mailbox shared across sim-lock, callout and lock-free ISR contexts without serialization — raced status word panics the kernel (or BDRs the wrong target); any chip wedge during timeout recovery ends in an unconditional panic after a 10-second interrupts-disabled spin

Summary

One shared LRAM mailbox (clear-STATUS/write-CMD/poll-STATUS) with no mutual exclusion across three caller domains: XPT_RESET under sim_mplock, adwtimeout under crit-only callouts (crit does not exclude other CPUs' sim-lock holders), and the lock-free ISR. A raced zeroing of IDLE_CMD_STATUS leaves the peer polling forever - 10s interrupts-disabled spin then panic; a torn PARAM/CMD interleave can device-reset the wrong target; even solo, a wedged chip during timeout recovery panics. Unpriv userspace drives it via queue saturation to a stalled target + concurrent resets. Hardware-gated. idle_lock + error-return fix.