When nhi fails to attach on one of my systems (X1 Carbon 6th gen), an
interrupt races with the teardown code such that the rings have been
freed by nhi_detach() before an interrupt triggers. At the time of
the crash, the thread invoking nhi_attach() is blocked in
bus_teardown_intr() from nhi_pci_free() waiting for the interrupt
thread to finish executing the handler.
To fix, don't just disable the interrupts in nhi_detach(), but
actually tear the handlers down and disable MSI-X before freeing the
rings.