# DF-3923 — hpt_attach failure path `kfree()`s the newbus-owned softc and leaves the freed adapter globally linked

## What
`sys/dev/raid/hptmv/entry.c:2022-2028` (hpt_attach):
```c
if (bus_setup_intr(pAdapter->hpt_dev, pAdapter->hpt_irq, 0,
            hpt_intr, pAdapter, &pAdapter->hpt_intr, NULL))
{
    hpt_printk(("can't set up interrupt\n"));
    kfree(pAdapter, M_DEVBUF);      /* <-- frees softc owned by newbus */
    return(ENXIO);
}
```
For a PCI driver the softc (`sizeof(IAL_ADAPTER_T)`, driver_t at entry.c:97-101)
is embedded in the newbus device and returned by `device_get_softc(dev)`
(entry.c:1992) — it is NOT a driver allocation. `init_adapter()` (called at
entry.c:2011, succeeding) has already:
- linked `pAdapter` into the global `gIal_Adapter` list (entry.c:1280-1287),
- started the MV core (`mvSataInitAdapter`, entry.c:1349),
- unmasked adapter interrupts (entry.c:1498).

After the kfree: the device still exists with a dangling softc; `gIal_Adapter`
still points at freed memory. Any later walk of that list — hptproc ioctls
(`Kernel_DeviceIoControl`, DF-1853 family), RESCAN_DEVICES (ioctl.c:302),
worker-thread SIGSTOP walk (entry.c:2438-2456) — dereferences freed memory.
Newbus itself touches the freed softc on device state changes (probe cycle,
detach, shutdown). Additionally the earlier IRQ-allocation failure path
(entry.c:2016-2020) returns without unlinking the adapter or releasing
`mem_res`, leaking a half-initialized adapter with interrupts unmasked.

Error-path gated (requires bus_setup_intr/bus_alloc_resource failure on a
present RR1820 — e.g. IRQ shortage in a passthrough VM), hardware-gated, but
a genuine use-after-free of kernel memory once hit.

## Fix
```diff
--- a/sys/dev/raid/hptmv/entry.c
+++ b/sys/dev/raid/hptmv/entry.c
@@ -2023,7 +2023,6 @@ hpt_attach(device_t dev)
 {
 	hpt_printk(("can't set up interrupt\n"));
-	kfree(pAdapter, M_DEVBUF);
 	return(ENXIO);
 }
```
plus proper teardown in `init_adapter`'s caller (unlink from gIal_Adapter,
release mem_res/irq) — see fix.diff.