# DF-5590 — isavga_attach() never unwinds the legacy VGA window claims on failure

## What this is

Evidence pack for the pass-2 finding on `sys/bus/isa/vga_isa.c`:

`isavga_attach()` activates the two legacy VGA resource windows
(SYS_RES_IOPORT 0x3c0-0x3df, SYS_RES_MEMORY 0xa0000-0xbffff) at
`sys/bus/isa/vga_isa.c:144-148`, discards both `bus_alloc_resource()`
return values, and then has **no error unwinding** when
`vga_attach_unit()` fails (`vga_isa.c:150-152`) or `fb_attach()` fails
(`vga_isa.c:158-160`).  There is no detach method at all
(`vga_isa.c:66-74`), so on a failed attach the claims are permanent.

The failure path is not exotic: `isavga_probe()` succeeds even when no
VGA hardware is present, because `vga_probe()` returns 0 unconditionally
after `probe_adapters()` fails verification (`sys/dev/video/fb/vga.c:838-852`,
`verify_adapter()` write/read test at vga.c:3951-... / probe_adapters at
vga.c:616-...).  On any legacy-BIOS boot without VGA decode (server with
onboard VGA disabled, `-vga none` style VM), the *expected* outcome is:
probe claims success -> attach claims both windows in the ISA rman ->
`vga_init()` returns ENXIO because `V_ADP_PROBED` was never set
(`vga.c:855-859`) -> attach fails -> claims leak forever on a zombie device.
With `options FB_INSTALL_CDEV` the `make_dev()`'d cdev also leaks
(`vga_isa.c:156-160`).

## Reproduce

Nothing to compile — this is runtime introspection of the live driver:

    ./run.sh          # from the repo root (uses dfbsd-qemu/vm.sh)

`run.sh` collects: dmesg attachment lines, the rman window claims
(`devinfo -rv`), and proof the mechanism exists on the running kernel
(vga0 attached on isa1 with exactly port 0x3c0-0x3df / iomem
0xa0000-0xbffff).

The **leak** itself requires attach to *fail*, i.e. a BIOS boot with no
VGA decode (QEMU `-vga none`, or onboard VGA disabled in BIOS).  The
audit rig's Bochs VGA always passes `verify_adapter()`, so the failure
branch cannot be entered on this guest — see VERDICT.md for the
line-by-line path trace.

## Expected output

Successful-attach baseline (what the rig shows):

    vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1

On a VGA-less BIOS machine the same GENERIC kernel would print nothing
for vga0 (attach fails) yet hold both rman claims — that asymmetry is
the bug; `fix.diff` unwinds it.