Why _FAST? It's called once.

Also, you could base this on the tv_sec field being != 0. That can Never happen for CLOCK_REALTIME.

Just that there's no reason for any real precision here given we only care about seconds granularity. I was assuming that we should use _FAST by default unless more precision is required?

In a loop, definitely optimize for fast. For a one-off call, optimizing for fast is harder to read, imho, so I use the standard form. It saves hitting the hardware once to get the latest TC, which is super cheap on modern time counters, and not that expensive on the exotics.

But where does last_disconnect get populated from? The kernel sets it, I know, but how/where is that set?

last_disconnect is updated via nanotime() in the softc each time a host disconnects. That field and the call to nanotime() are in the previous review in this stack (D48219) adding the connection status ioctl.