We found another issue in testing with the sx held across device_detach(). device_sysctl_fini() in subr_bus.c sleeps in sysctl_ctx_free() (kern_sysctl.c) waiting for in-flight handlers to finish, but device_sysctl_handler() needs bus_topo_lock(). So if something is reading one of the device's sysctls (%iommu in our case) while it detaches, both sides get stuck. With just Giant this was fine, since it gets dropped across the sleep.

We pulled an earlier version of this (378b273) without the mi_startup() locking. The sx_assert caught a few Giant-only callers: