The flip: PCI enumeration leaves the kernel (M19.3)

enumeratePci, addBars, pciConfigurationPtr, and the PciHeader struct are
deleted; the kernel seeds only the host bridge, and the ring-3 pci-bus
driver's reports are the sole source of PCI function nodes. The manager
matches PCI drivers from reported identity, deduped by registered device
id so a bus restart never double-spawns.

The flip did its job by exposing a latent SMP race: ring-3
device_register made the broker table concurrent for the first time, and
mmio_map read it lock-free — under load a torn resource length mapped
hpet's window wrong (its user fault) and underflowed r.len-1 into a
kernel integer-overflow panic. Fixed: the broker read in mmio_map (and
claim) runs under the big kernel lock, the arithmetic rejects
zero-length and wrapping windows cleanly, and pci-bus no longer registers
unimplemented size-0 BARs. driver-restart hammered 6x, suite 55/55.

docs/m19-m20-plan.md

@@ -96,11 +96,15 @@ branch is green; keep branches; push everything.
       and asserts the PCI node count never grows — plus harness hardening: a
       failing case now preserves its serial as <case>-failed-serial.log, and
       the heavy scenarios run at 150s; suite 55/55).
-- [ ] **M19.3** — the flip: kernel `enumeratePci` call removed (bridge node
-      stays); manager matches PCI drivers from reports. One commit. The
-      existing xHCI scenarios (`driver-restart`, `usb-report`, `device-list`)
-      are the assertion — xhci must come up spawned off a pci-bus report, and
-      the suite must not be able to tell the difference. discovery.md updated.
+- [x] **M19.3** — the flip: kernel `enumeratePci`/`addBars`/`PciHeader` all
+      deleted (bridge node stays); manager matches PCI drivers from reported
+      identity, deduped by registered id. Surfaced and fixed a real SMP race the
+      flip created — ring-3 device_register made the broker table concurrent, so
+      mmio_map's lock-free read intermittently tore hpet's resource length
+      (user fault) and overflowed `r.len-1` into a kernel panic; now the broker
+      read is under the big lock and the arithmetic is guarded, and pci-bus
+      skips size-0 BARs. discovery.md updated; suite 55/55 (driver-restart
+      hammered 6×).
 - [ ] **merge** `feat/pci-bus` → main, push.
 - [ ] **M20.1** — acpi service, parse only (fills the existing placeholder at
       system/services/acpi/acpi.zig): kernel publishes `acpi-tables`