iicbus ownership protocol is not MP-safe and mis-ordered: crit_enter gives no cross-CPU exclusion (double-acquire), and iicbus_release_bus frees the bridge resource BEFORE validating ownership (non-owner teardown of bridge exclusion)

Summary

The owner check-then-set runs under crit_enter, which on DF masks interrupts per-CPU only (IICBUS_LOCK is a no-op per DF-2313): two requesters on different CPUs can both observe owner==NULL and both set owner (both return 0 believing they own the bus). Compounding, release_bus performs the bridge-level release FIRST and validates ownership after: a non-owner drops the ppbus-level exclusion out from under the real owner, and the EACCES path skips wakeup entirely. Wire/protocol-level corruption of external devices (EEPROM/SMBus registers) on realistic SMP contention (/dev/iic0 vs /dev/smb0 vs ipmi_ssif); kernel-memory-safe. Inspection-proven (crit_enter semantics); the DF-5563 spinlock protocol fix covers it (validate-before-callback + unconditional wakeup).