kobject_release leaks kobj->name string allocated by kobject_init_and_add

Summary

kobject_init_and_add() allocates kobj->name via kvasprintf(M_WAITOK fmt ap) storing separately-mallocd string. kobject_release() only invokes kobj->ktype->release(kobj) never frees kobj->name. Upstream Linux frees it in kobject_cleanup() via kfree_const(kobj->name) after type-specific release. None of in-tree release callbacks (ttm_bo_global_kobj_release ttm_mem_zone_kobj_release ttm_mem_global_kobj_release ttm_pool_kobj_release x2 ttm_drm_class_device_release) free name either they only kfree() container struct which contains kobject by value so separately-allocated name pointer is lost on every release. ~5-7 kobjects per DRM subsystem init each full load/unload cycle leaks ~100-200 bytes M_DRM. Format strings are kernel literals producing ~15-30 byte strings. No UAF: leaked name buffer never re-accessed after embedding kobject freed (pointer simply lost). Required position: root kldload/kldunload cycles or GPU hotplug. Slow unbounded kernel memory growth availability only no confidentiality/integrity impact.