[PASS] retry_clone calls ath_tx_dmasetup(sc, nbf, nbf->bf_m) -- if_ath_tx.c:4540
[PASS] on dmasetup error nbf is recycled via ath_returnbuf_head -- if_ath_tx.c:4571
[PASS] no mbuf free / node decref before recycling nbf -- if_ath_tx.c:4571-4585
[PASS] error path returns NULL (caller drops the ORIGINAL bf)
[PASS] ath_buf_clone moves bf_m/bf_node into tbf (no incref) -- if_ath.c:3170
[PASS] ath_tx_dmasetup frees m0 on error (nbf->bf_m dangles post-free) -- if_ath_tx.c:294
[PASS] _ath_getbuf_locked sanitizes flags/state but NOT bf_m/bf_node -- if_ath.c:3080
[PASS] ath_freebuf KASSERTs bf_node==NULL/bf_m==NULL (ref contract) -- if_ath.c:4844

DF-3638 CONFIRMED at source level