dmi_match() leaks kgetenv() buffer on every code path

Summary

dmi_match() calls kgetenv() on four switch arms (DMI_SYS_VENDOR DMI_BOARD_VENDOR DMI_PRODUCT_NAME DMI_BOARD_NAME) and stores result in s but never calls kfreeenv() on it. kgetenv() allocates fresh kernel heap buffer of strlen(value)+1 bytes from M_KENV whenever dynamic kernel environment active (production default). Each call leaks up to KENV_MVALLEN+1 bytes (~129 bytes). Every correct in-tree consumer honors kgetenv/kfreeenv pairing: kgetenv_string() kern_environment.c:369 does kfreeenv(tmp) sibling DMI helper dmi_found() drm_drv.c:1329-1336 calls kfreeenv() on all four fields. dmi_match() omits frees entirely on both return true and fall-through return false paths. s goes out of scope allocation unreachable. Sole in-tree caller radeon_atom_pick_dig_encoder() atombios_encoders.c:2251 gated by ASIC_IS_DCE32 (DCE3.2/HD4000 radeon). Invoked during encoder assignment on display init and DP/HDMI hotplug and mode-set events reachable through /dev/dri/cardN by user holding DRI device. Sustained triggering drains kernel heap no bound. No memory-corruption primitive. Impact: DoS via kheap exhaustion. Also exported LinuxKPI shim any future port inherits leak.