sgread(): unlocked re-check of rdwr->state races another reader's remove+free — 4-byte use-after-free read and tsleep on a freed object (PINTERLOCKED pattern)

Summary

The lost-wakeup interlock pattern re-reads rdwr->state AFTER cam_periph_unlock: a second reader can remove+free the entry (window widened by two uiomoves with page faults) - the first reader then reads freed M_DEVBUF memory and possibly tsleeps on the freed address. UAF-read-driven control flow, no write primitive. Never-deref-after-unlock + claimed-flag fix.