CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hcisync: annotate data-races around hdev->reqstatus

hcicmdsyncsk() sets hdev->reqstatus under hdev->reqlock:

hdev->reqstatus = HCIREQPEND;

However, several other functions read or write hdev->reqstatus without holding any lock:

- hcisendcmdsync() reads reqstatus in hcicmdwork (workqueue) - hcicmdsynccomplete() reads/writes from HCI event completion - hcicmdsynccancel() / hcicmdsynccancelsync() read/write - hciabortconn() reads in connection abort path

Since hcicmdsyncsk() runs on hdev->reqworkqueue while hcisendcmdsync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race.

Add READONCE()/WRITEONCE() annotations on all concurrent accesses to hdev->reqstatus to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the waitevent condition or store reordering).