[PASS] ath_tx_start calls ath_tx_normal_setup into r -- line 2021
[PASS] failure branch jumps to done -- line 2023: if (r != 0) / goto done;
[PASS] done: label exists after failure branch -- line 2081
[PASS] done: block returns literal 0 (r discarded) -- lines 2081-2084
[PASS] dmasetup error path frees mbuf before returning error -- function at line 294
[PASS] caller ath_raw_xmit branches on non-zero return -- line 2422
[PASS] ath_raw_xmit grabs bf via ath_getbuf before ath_tx_start -- line 2407
[PASS] success path never returns bf (no ath_returnbuf on r==0) -- lines 2422-2431

DF-3637 CONFIRMED at source level