LKM screen-saver module unload TOCTOU: remove_scrn_saver samples scrn_blanked and clears current_saver with no syscons_lock, so kldunload can unmap the saver module (fade_saver et al.) while fade_saver is still executing — use-after-free of module text and statics

Summary

remove_scrn_saver (syscons.c:2613-2627) waits and publishes current_saver=none_saver with NO syscons_lock while every saver entry runs under it (scrn_timer) or vga_token-only (FBIO_BLANK) - kldunload winning the first-blank transition lets link_elf_unload_file unmap module text/statics while fade_saver executes (palette[768], count at :46,52). Root-gated, microsecond window, panic ceiling. QEMU-live evidence: kldload proves fade_init ran; FBIO_BLANK amplifier dead on this guest (fbi==NULL ENODEV). syscons_lock-across-wait fix (interlocked variant already exists). DISTINCT from DF-5195 (that is a vga_token sleep inversion deadlocking a blanked stop; this is an unlocked removal racing a blank START).