dm_dev_create assigns freed dmv to *dmvp on insert-failure path

Summary

When dm_dev_insert fails (returns EEXIST) dm_dev_create calls dm_dev_destroy(dmv) which frees dmv but then unconditionally executes *dmvp=dmv handing caller pointer to freed kernel memory. Currently benign: sole caller dm_dev_create_ioctl only dereferences dmv when r==0 but latent caller-side UAF any future caller that uses *dmvp unconditionally or any code that inspects out-parameter would touch freed memory.