ukbd_detach mutates keyboard state and runs ukbd_interrupt() without kb_lock, racing the kb_lock-holding ukbd_timeout callout (in-bounds input-ring corruption on unplug)

Summary

Every other path runs under kb_lock; detach runs crit-only and memset+ukbd_interrupt unlocked - a ukbd_timeout fired just before the stop can concurrently run ukbd_interrupt under the lock: double-advance/double-count of the input ring (all in-bounds; lost/duplicated release events + count drift only). UKBD_LOCK_ASSERT compiles to (void)0 so nothing catches it. Lock-around-the-flush fix.