fwohci_irx_disable/fwohci_itx_disable free DMA buffers after a fixed 1-tick tsleep without confirming the OHCI context halted (device-write UAF window into freed memory)

Summary

Both disable paths clear RUN, tsleep a fixed hz (the driver's own XXX acknowledges 'we cannot free buffers until the DMA really stops'), then db_free - a controller that lags >10ms or ignores the stop keeps writing received packets into freed DMA memory (device-driven heap UAF). Compliant hardware halts in ~125us so latent hardening; poll-ACTIVE-with-timeout fix.