# DF-2086 — ata_dmaalloc double-free on error path

## Verdict
REPRODUCED (source-only confirmation). Bug confirmed by source tracing.

## Mechanism
ata_dmaalloc error path (ata-dma.c:149-153) calls ata_dmafree(dev) which kfrees ch->dma at line 196, then line 152 kfree(ch->dma,M_ATADMA) frees the same pointer again. ata_dmafree does not NULL ch->dma after freeing.

## Fix
Remove the redundant kfree(ch->dma,M_ATADMA) from the error path; keep ch->dma=NULL.

## Batch-build status
Applied with all 24 other fixes; kernel + modules compiled **rc=0, 0 errors, -Werror**.