# DF-4261 — `acpi_pst_attach()` leaks the allocated _PCT bus resources on every error path after `acpi_pst_alloc_resource()`

## Impact
Info (hardening / correctness). Boot-time bus-resource leak (I/O port or
memory window + permanently bumped `cpu_next_rid` in the parent cpu softc)
when the _PSS/_PPC/_PDL objects of a crafted ACPI table fail validation after
_PCT registers were successfully allocated. Requires attacker-controlled ACPI
tables (firmware/loader privilege), so no runtime privilege boundary is
crossed — but it is a real error-path asymmetry that a maintainer can act on,
and resource leaks at failed attach are exactly the class that later turns
into use-after-free/range-confusion when drivers are re-probed.

## Where (sys/dev/acpica/acpi_cpu_pstate.c)
- :499-504 control register allocated (`sc->pst_creg.pr_res`, rid bumped at
  acpi_pst_alloc_resource:1508-1516)
- :511-516 status-register GAS extraction fails -> `return error` with
  `pst_creg.pr_res` still held
- :545-547, :551-554, :570-574, :589-594, :596-603, :605-611 every _PSS
  validation failure returns with BOTH registers held
- :688-690 (_PPC), :734-736 (_PDL) same

## Fix
`fix.diff`: add `acpi_pst_release_resource()` (type derived from
`pr_gas.SpaceId` exactly like `acpi_bus_alloc_gas`, sys/dev/acpica/acpi.c:1261-1270)
and route all post-_PCT failures through a `failed:` label. Not
compile-validated (Info-severity, not exercised at runtime).

## Verification
Not executed (Info hardening finding; live trigger needs a crafted ACPI SSDT
via `-acpitable`, and the guest's QEMU SSDT exposes no _PSS/_PCT at all —
`dev.cpu.0` has no freq nodes). Code-path proof is complete in VERDICT.md.