kern/60544: nvmm_vcpu_run: use after mutex release

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60544
>Category:       kern
>Synopsis:       nvmm_vcpu_run: use after mutex release
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 06 01:20:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9
>Organization:
Acme VM Stoppers, Inc.
>Environment:
>Description:
    666 	error = nvmm_vcpu_get(mach, args->cpuid, &vcpu);
    667 	if (error)
    668 		goto out;
    669 
    670 	error = nvmm_do_vcpu_run(mach, vcpu, &args->exit);
    671 	nvmm_vcpu_put(vcpu);
...
    675 	if (vcpu)
    676 		vcpu->comm->stop = 0;

https://nxr.netbsd.org/xref/src/sys/dev/nvmm/nvmm.c?r=1.48#655

	Unclear why vcpu->comm->stop is supposed to happen so late and
	not immediately after nvmm_do_vcpu_run returns before we
	invalidate vcpu by nvmm_vcpu_put(vcpu).

	Reported by maxv.

>How-To-Repeat:

	code inspection

>Fix:

	Move the vcpu->comm->stop = 0 earlier.