DF5546 baseline attempt 1 — WRONG EMULATED HARDWARE (documenting the precondition hunt)

Guest booted with `-device qemu-xhci` (1b36:000d). That QEMU device
implements MSI-X ONLY (pciconf -lc shows `cap 11[90] = MSI-X`, no cap 05),
and DragonFly's pci_alloc_1intr()/pci_alloc_msi() allocates CLASSIC MSI
only — so nothing was ever allocated and there is nothing to leak:

    xhci0 pre-detach: sc_irq_rid=0 sc_irq_res=0 sc_intr_hdl=0
    MSI cap @0xffffffff ctrl=0xffff (enable bit SET)   <- cap walk found no MSI cap
    device_detach(xhci0) returned 0
    post-detach MSI ctrl=0xffff (enable bit STILL SET)
    pci_release_msi(xhci0) probe returned 19 (clean: nothing left to release)

Switching the guest to `-device nec-usb-xhci,msi=on,msix=off` (NEC
uPD720200, chip 0x01941033 — which is even in this driver's own quirk
tables at xhci_pci.c:94/:210) provides a classic-MSI xHCI and the leak
manifests (see run.log):

    xhci0 pre-detach: sc_irq_rid=1 sc_irq_res=0 sc_intr_hdl=0
    ...
    pci_release_msi(xhci0) probe returned 0 (LEAK: driver left MSI vectors allocated)

Hardware precondition for the leak: an xHCI controller exposing a
classic MSI capability (mandatory-support device class per xHCI spec
§4.8; qemu-xhci is simply MSI-X-only).