xpt_release_device() uses non-joining callout_stop before kfree(device) — xpt_release_devq_timeout can already be blocked on CAM_SIM_LOCK(device->sim) and then operate on the freed cam_ed (UAF; upstream defers the free)

Summary

On AC_LOST_DEVICE with a pending RELSIM_RELEASE_AFTER_TIMEOUT callout: refcount 1->0 -> callout_stop (no join) -> kfree(device), while the callback may be blocked acquiring the SIM lock held by the releasing context - it then proceeds after the kfree, touching device->sim lock pointer and mutating freed EDT fields. Upstream FreeBSD defers the free via device_destroy_task precisely for this. Race-gated (callout expiry vs last ref drop); source-verified, not reproduced - honest speculative. callout_stop_sync or task-deferred free fix.