Terminal-emulator registry sc_term_list is completely unsynchronized and the SCTERM_MODULE MOD_UNLOAD refcount gate is TOCTOU — kldload/kldunload of any third-party scterm module races console ioctls into list corruption or a call into freed module text

Summary

add/remove mutate the global list with no lock while the two match walks run under inconsistent tokens (syscons_lock vs vga_token) and the unload EBUSY gate is non-atomic with the te_init refcount acquisition. Latent in-tree (both emulators static, no loadable scterm modules exist) - an API hazard for third-party module authors, root-gated. Dedicated-spinlock + atomic-gate fix.