cmx_detach lifetime holes: dying is checked unlocked before CMX_LOCK (TOCTOU across lockuninit) and registered knotes are never detached from sc->kq.ki_note — knote cleanup after softc free is a use-after-free

Summary

(a) open/read/write test dying outside the lock while detach sets it unlocked then lockuninits - a passed check proceeds to lock a destroyed lock. (b) detach KNOTEs only when polling was set; kqfilter-registered knotes stay on ki_note forever - after softc free, kqueue teardown's filter_detach computes klist on the dangling softc and knote_remove writes freed memory. device_busy + dying-under-lock + unconditional-KNOTE fix.