Double-free / UAF in fwohci_pci_add_child error path: detach deletes child then caller deletes it again

Summary

In fwohci_pci_add_child if device_probe_and_attach(child) fails error handler calls fwohci_pci_detach(parent) which internally calls device_delete_child(self sc->fc.bdev) freeing the child device struct via kobj_delete. Control returns to add_child which immediately calls device_delete_child(parent child) on now-freed pointer producing UAF read on child->state potential corrupted-list TAILQ_REMOVE and kobj_delete double-free. sc->fc.bdev set to NULL after detach but local child still holds dangling pointer. sc->fc.bdev IS the same child pointer (set at :439). Currently unreachable (firewire probe/attach always return 0) but latent memory-corruption defect.