iommu: per-device domains with interim DMA-pool enforcement

Replaces L1's shared blanket identity domain with a private translation
domain per claimed PCI function. A device now reaches only:
  - the DMA pool: every dma_alloc'd region, mapped into every claimed
    device's domain (poolAdd/poolRemove, driven from the dma_alloc and
    dma_free syscalls). This keeps the cross-process buffer handoff
    working (fat's bounce buffer reaches the xHC) while blocking the
    kernel, page tables, process heaps, MMIO, and unallocated RAM.
  - its own firmware reserved region (RMRR), seeded at confine time.
The pool is the honest interim: devices can still reach one another's
DMA buffers. The DMA-region capability layer (next) narrows it to
per-grant reachability.

dma_free unmaps from every domain and invalidates BEFORE the frames
return to the allocator, closing the stale-IOTLB use-after-free window.
Driver death tears down its domains (detach + free tables) before the
broker claims and DMA frames are released.

New iommu_fault_drain syscall (+ driver.iommuFaultDrain) forces pending
fault records to the log on demand. The new iommu-fault case proves it:
a claimed e1000e is programmed to DMA-fetch its TX ring from an unmapped
page; VT-d faults the access (bdf 00:03.0 addr 0x1000 reason 0x6) and the
system stays alive. 104/104.

system/kernel/process.zig

@@ -251,6 +251,7 @@ fn system_call(state: *architecture.CpuState) void {
         .fs_node => systemFsNode(state),
         .fs_mount => systemFsMount(state),
         .fs_unmount => systemFsUnmount(state),
+        .iommu_fault_drain => systemIommuFaultDrain(state),
         .wall_clock => systemWallClock(state),
         .shared_memory_create => systemSharedMemoryCreate(state),
         .shared_memory_map => systemSharedMemoryMap(state),
@@ -509,6 +510,17 @@ fn systemIoWrite(state: *architecture.CpuState) void {
 /// their physical address is never disclosed. `dma_below_4g` caps the physical address
 /// for legacy engines; `dma_write_combining` is accepted but falls back to coherent
 /// until PAT is programmed. See docs/driver-model.md (M14).
+/// iommu_fault_drain() -> count: drain and log any pending IOMMU translation faults,
+/// returning how many were seen. A diagnostic hook — a driver (or a test) that suspects
+/// its device faulted can force the fault records to be logged now rather than waiting
+/// for the next device-release drain. Harmless without an IOMMU (returns 0).
+fn systemIommuFaultDrain(state: *architecture.CpuState) void {
+    const flags = sync.enter();
+    const count = iommu.faultDrain();
+    sync.leave(flags);
+    architecture.setSystemCallResult(state, count);
+}
+
 fn systemDmaAlloc(state: *architecture.CpuState) void {
     const len = architecture.systemCallArg(state, 0);
     const flags = architecture.systemCallArg(state, 1);
@@ -555,6 +567,13 @@ fn systemDmaAlloc(state: *architecture.CpuState) void {
         architecture.mapUserDmaInto(t.address_space, base_v + i * page_size, phys + i * page_size, page_size);
         sync.leave(lock_flags);
     }
+    // Publish the region to the DMA pool: it becomes reachable to every claimed device
+    // (the interim rule until DMA-region capabilities land). No-op without an IOMMU.
+    {
+        const lock_flags = sync.enter();
+        iommu.poolAdd(phys, pages * page_size);
+        sync.leave(lock_flags);
+    }
     architecture.setSystemCallResult(state, base_v); // virtual address for the CPU
     architecture.setSystemCallResult2(state, phys); // physical address for the device
 }
@@ -572,6 +591,17 @@ fn systemDmaFree(state: *architecture.CpuState) void {
     const pages: usize = @intCast((len + page_size - 1) / page_size);
     if (base_v < dma_arena_base or base_v + pages * page_size > dma_arena_end) return fail(state);
 
+    // Pull the region out of every device's domain and invalidate BEFORE any frame
+    // returns to the allocator — a device still translating to a reallocated frame is a
+    // use-after-free. dma_alloc's frames are contiguous, so the base translation names
+    // the whole region.
+    {
+        const lock_flags = sync.enter();
+        if (architecture.translate(t.address_space, base_v)) |base_phys|
+            iommu.poolRemove(base_phys, pages * page_size);
+        sync.leave(lock_flags);
+    }
+
     for (0..pages) |i| {
         const va = base_v + i * page_size;
         // Per-page lock hold: the translate/unmap walks the shared page tables