devaddq() error path frees wrong variable leaking 1024 bytes of M_BUS on allocation pressure

Summary

devaddq bad: cleanup third kfree tests loc!=NULL instead of data!=NULL. When loc allocation fails (data already allocated) data never freed leaking 1024-byte M_BUS allocation per failed device event notification. Under sustained memory pressure accelerates exhaustion. Copy-paste error third guard re-tests loc but frees data. loc-failure path loc==NULL skips kfree(data).