Summary

ata_pccard_attach() allocates io (and conditionally ctlio) IOPORT resources at ata-card.c:88-118 then calls ata_probe()/ata_attach() at tail of function and returns their error code verbatim with no cleanup (ata-card.c:125-128). DragonFlyBSD newbus (subr_bus.c:2108-2124 device_doattach) deliberately does NOT invoke DEVICE_DETACH when DEVICE_ATTACH returns non-zero -- merely clears driver pointer sets state=DS_NOTPRESENT. So whenever ata_attach() fails (IRQ allocation failure ata-all.c:137-140 or bus_setup_intr failure ata-all.c:141-146) io and ctlio resources allocated earlier are orphaned: remain claimed in rman struct resource/kmem backing never freed. Detach routine ata_pccard_detach() at :131-146 DOES release these correctly but is never called by newbus on attach failure (device_detach subr_bus.c:2136 short-circuits state!=DS_ATTACHED). Trigger: PCMCIA/CardBus slot card whose CIS causes probe success but IRQ cannot be allocated or bus_setup_intr fails. Each failed attach leaks 1-2 struct resource entries plus rman allocations. Repeated insert/eject cycles exhaust rman entries/kernel memory local DoS. No mem corruption no priv-esc bounded to resource exhaustion.