Async-attach thread races driver deregistration/device deletion: device_t has no refcount and device_detach() short-circuits DS_INPROGRESS to success, allowing device_set_driver() to free the softc/kobj while device_attach_thread() is inside DEVICE_ATTACH()

Summary

With kern.do_async_attach=1 (non-default tunable) the attach thread runs DEVICE_ATTACH unsynchronized while device_t has no refcount: concurrent deregistration hits detach's state!=DS_ATTACHED -> return 0 short-circuit and frees the softc/kobj mid-attach - a UAF write into the freed device (nfe/em/emx opt into DF_ASYNCPROBE so the window is real when enabled). Not reachable on default config; honestly speculative/untested. refuse-DS_INPROGRESS fix proposed.