Summary

bt_pci_attach creates DMA tag stored in bt->parent_dmat (bt_pci.c:133-142) but neither error path (147-150 and 154-157) nor eventual bt_free_softc teardown destroys it. bt_free_softc (bt.c:178-235) destroys all child DMA tags (mailbox/buffer/ccb/sg/sense_dmat) but never parent_dmat. parent_dmat only created at bt_pci.c:142 used as parent for child tags (bt.c:612,627,668,701) never destroyed. Leak on every attach failure and on any future detach. No direct security impact reachable only at boot/module-load when BusLogic PCI controller (0x104B/0x1040 or 0x0140) fails to init or root kldload/kldunload cycling. No memory corruption no UAF no privilege impact. Defense-in-depth clean error-path teardown reduces risk future refactors turn leak into UAF/double-free.