# DF-2305 — bus_dma_tag_create failure returns without cleanup

Verification pack for finding DF-2305 (`sys/bus/firewire/fwohci_pci.c:320-324`).
Low / base:hw. Claim: when `bus_dma_tag_create` fails, `fwohci_pci_attach`
returns ENOMEM directly — unlike its sibling error paths at :282, :296 and
:330, which all call `fwohci_pci_detach(self)` first — leaking the memory
BAR resource (sc->bsr), the IRQ resource (sc->irq_res), and leaving the
interrupt handler (sc->ih / fwohci_intr) registered.

## Verdict (short)

REPRODUCED on the verbatim-interposition harness: with `bus_dma_tag_create`
interposed to fail exactly at its fwohci_pci.c:300 call inside the REAL
`fwohci_pci_attach`, the driver returned ENOMEM having consumed (rig
accounting, deltas): **MEM 1 alloc / 0 releases, IRQ 1/0, setup_intr 1 /
teardown 0** — BAR + IRQ leaked and `fwohci_intr` left registered. A clean
re-attach attempt was then refused by the rman-conflict model
("Could not map memory", ENXIO) because the BAR is still outstanding, and
the failed re-attach additionally overwrites `sc->bsr` with NULL, orphaning
the BAR permanently. The sibling path (irq-alloc failure at :280, forced
through the same rig) allocates and releases in balance (MEM 1/1) because
it calls detach. A rig-only forced detach of the leaked state released
exactly what the stock error path left behind — proving the missing call
is the only difference.

Reachability (honest): needs a real fwohci PCI card AND
`bus_dma_tag_create` failing — on x86_64 that is the
`alloc_bounce_pages` ENOMEM path (busdma_machdep.c:820-860, active when
lowaddr=BUS_SPACE_MAXADDR_32BIT < installed RAM, i.e. any >4GB host,
combined with severe memory pressure), or the tag kmalloc (M_INTWAIT,
effectively never). Rare but real; hardware-gated. On top of the leak,
`device_doattach` frees the softc after the failed attach
(subr_bus.c:2121 device_set_driver -> kfree softc) while the handler stays
registered — on shared-IRQ hardware that is an interrupt-context
use-after-free of the softc pointer.

## Files

Same rig as DF-2304 (shared verbatim-interposition harness):
* `fwpci_harness.c/h`, `fwohci_harness.c/h`, `fwpcictl.c` — rig
* `run.sh` — the four-step proof (A leak / C forced-detach / D sibling / B permanence)
* `run.log`, `dmesg.txt` — baseline output + console lines
* `run_fixed.log` — fixed-kernel A/B (balanced + re-attach unblocked)
* `fix.diff` — combined 3-hunk fix (hunk 2 adds the missing detach)

## Reproduce

```
scp -F dfbsd-qemu/config * dfbsd:/root/fwo/
vm.sh run_root 'sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh'
vm.sh down && vm.sh up
vm.sh run_root 'sh /root/fwo/run.sh'
```
Expected: A shows rc=12 with MEM 1/0 IRQ 1/0 setup 1/teardown 0
live_handlers=1; C releases everything; D balanced; B conflict+ENXIO.