QEMU can use freed serial state if the port is hot-unplugged
Brief
We do not know whether an unprivileged guest can force that path without the host unplugging the device.
Notes
eb3f7fe382ba (Paolo Bonzini, 2026-08-20). serial: clear transmit retry callback on unrealize. Resolves work_items/4125 (issues API 404). The public commit calls it a use-after-free on hot-unplug.
Landed with f57fc2f7 Merge tag for-upstream (2026-08-20 16:01 PT).
Commit eb3f7fe382babbab44419603e81da56abb91d11a