pci_devq mutated without pci_token (pci_read_device/pci_freecfg) while PCIOCGETCONF walks the list under pci_token — use-after-free read race

Summary

The pciconf ioctl walks pci_devq under the static pci_token but the only mutators (pci_read_device insert, pci_freecfg remove+free) take no lock - a CardBus insertion/removal concurrent with a root pciconf listing can free a devinfo the ioctl is dereferencing (UAF read, crash). Thin window, privileged+physical+legacy hardware. Token-around-mutation fix.