iwm_notification_wait_free() frees the wait structure with no drain of threads still sleeping in iwm_wait_notification(); the only guard is a KASSERT compiled out on non-INVARIANTS kernels, so a detach racing an in-flight waiter operates on freed memory

Summary

Detach drains tasks/callouts only - a waiter sleeping in lksleep (which released IWM_LOCK) holds nothing detach blocks on; if its timeout fires after lockuninit+kfree the wake path lockmgrs a destroyed lock and STAILQ_REMOVEs freed memory (UAF write; INVARIANTS kernels panic at the compiled-in KASSERT instead). Root-gated hot-unplug race. Abort-wiring + always-on-KKASSERT fix.