iommu: DMA-region capabilities — per-grant reachability, protocol flag-day

Replaces L2's interim DMA pool (every buffer reachable by every claimed
device) with true per-grant confinement: a device reaches only buffers
whose capability was delegated to its driver.

Kernel:
- DmaRegionObject (handle kind 2): a delegation token naming a dma_alloc'd
  region, passable across processes on the IPC cap slot like an endpoint
  or shared-memory object. Frames stay owned by the allocating address
  space (freed on dma_free/teardown as before); the token carries a `dead`
  flag so a stale downstream handle can no longer bind a freed region.
- dma_alloc gains the dma_shareable flag: it returns a capability handle
  in r8 and every region is tracked in a registry. A task's own regions
  auto-bind into the devices it claims (its rings just work); foreign
  buffers are bound explicitly.
- dma_bind / dma_unbind / handle_close syscalls (51-53). dma_bind maps a
  held region (or shared-memory) capability into a claimed device's domain;
  it is idempotent. handle_close reclaims a table slot (raised 16 -> 32).
- dma_free and task death unmap a region from every domain and invalidate
  BEFORE its frames return to the allocator — the stale-IOTLB use-after-
  free window, closed structurally.

Protocols (flag-day): block gains attach, usb-transfer gains dma_attach —
each carries a region capability on the cap slot. fat allocates its bounce
buffer shareable and attaches it; usb-storage allocates its transport
buffers shareable, attaches them to the controller, and forwards fat's
capability downstream; usb-xhci-bus binds and closes; virtio-gpu binds its
shared scanout surface. The physical addresses on the wire are unchanged
(identity IOVA), so no register-programming code moved.

Cross-process DMA (fat -> usb-storage -> xHC) now flows only through
delegated capabilities. iommu-usb-storage / iommu-usb-hid / iommu-fault
all green under per-grant enforcement; 104/104 overall (fail-open paths
unchanged).

system/kernel/ipc-synchronous.zig

@@ -154,6 +154,66 @@ pub fn dropRef(endpoint: *Endpoint) void {
 /// Defined here (not in scheduler) because the meaning is the IPC/capability layer's.
 pub const handle_kind_endpoint: u8 = 0;
 pub const handle_kind_shared_memory: u8 = 1;
+pub const handle_kind_dma_region: u8 = 2;
+
+/// A DMA buffer's delegation token: names the `pages` contiguous frames at `phys` that
+/// `dma_alloc` handed its `owner`, and can be passed across processes as a capability so
+/// the driver that owns a device can bind it into that device's IOMMU domain
+/// (`dma_bind`). Unlike `SharedMemoryObject` this does NOT own the frames — the
+/// allocating address space still does, and frees them on `dma_free` or teardown — so
+/// this is a pure token: `dead` is set when the allocator frees the region, after which
+/// a stale handle can no longer bind it. `refcount` counts the allocator's registry
+/// entry plus every outstanding handle; the object is freed when the last drops.
+pub const DmaRegionObject = struct {
+    refcount: u32 = 1,
+    phys: u64,
+    pages: usize,
+    owner: u32,
+    dead: bool = false,
+};
+
+/// Create a DMA-region token for `pages` frames at `phys` owned by task `owner`. The
+/// frames are already allocated and mapped by the caller; this only wraps them for
+/// delegation. null if the heap is out of room.
+pub fn createDmaRegion(phys: u64, pages: usize, owner: u32) ?*DmaRegionObject {
+    const region = heap.allocator().create(DmaRegionObject) catch return null;
+    region.* = .{ .phys = phys, .pages = pages, .owner = owner };
+    return region;
+}
+
+/// Drop a DMA-region reference; free the token when the last (registry + handles) goes.
+/// Never frees frames — the allocator owns those.
+pub fn dropDmaRegionReference(region: *DmaRegionObject) void {
+    if (region.refcount > 1) {
+        region.refcount -= 1;
+    } else {
+        heap.allocator().destroy(region);
+    }
+}
+
+/// Resolve a handle to its DMA-region token, or null if out of range, unused, or a
+/// different kind.
+pub fn resolveDmaRegion(t: *Task, h: u64) ?*DmaRegionObject {
+    if (h >= t.handles.len) return null;
+    const entry = t.handles[@intCast(h)] orelse return null;
+    if (entry.kind != handle_kind_dma_region) return null;
+    return @ptrCast(@alignCast(entry.ptr));
+}
+
+/// Install a DMA-region handle in task `t`'s table (the slot owns a reference).
+pub fn installDmaRegionHandle(t: *Task, region: *DmaRegionObject) i64 {
+    return installEntry(t, .{ .kind = handle_kind_dma_region, .ptr = @ptrCast(region) });
+}
+
+/// Drop the handle at slot `h` of task `t` (handle_close): release its reference and
+/// free the slot. Returns 0 or -EBADF.
+pub fn closeHandle(t: *Task, h: u64) i64 {
+    if (h >= t.handles.len) return -EBADF;
+    const entry = t.handles[@intCast(h)] orelse return -EBADF;
+    dropEntry(entry);
+    t.handles[@intCast(h)] = null;
+    return 0;
+}
 
 /// A page-aligned block of **shared cacheable RAM** (docs/display-v2.md), referenced by
 /// capability handles across processes and freed when the last one drops. `phys` is its
@@ -307,6 +367,10 @@ fn shareCapability(from: *Task, to: *Task, cap: u64) i64 {
             const s: *SharedMemoryObject = @ptrCast(@alignCast(entry.ptr));
             s.refcount += 1;
         },
+        handle_kind_dma_region => {
+            const r: *DmaRegionObject = @ptrCast(@alignCast(entry.ptr));
+            r.refcount += 1;
+        },
         else => return -EBADF,
     }
     const handle = installEntry(to, entry);
@@ -574,6 +638,7 @@ fn dropEntry(entry: scheduler.HandleObject) void {
     switch (entry.kind) {
         handle_kind_endpoint => dropRef(@ptrCast(@alignCast(entry.ptr))),
         handle_kind_shared_memory => dropSharedMemoryReference(@ptrCast(@alignCast(entry.ptr))),
+        handle_kind_dma_region => dropDmaRegionReference(@ptrCast(@alignCast(entry.ptr))),
         else => {},
     }
 }