Summary

isp_pci_mbxdma creates the master tag and allocates pcmd_pool, xflist/tgtlist, control-space tag+memory, per-channel FC scratch, and per-cmd dma maps. Every failure path after the master-tag creation returns without bus_dma_tag_destroy, and on the success path NOTHING frees any of it: isp_uninit only resets the chip, isp_detach frees only CAM resources, isp_pci_detach frees only isp_param and pc.ptr - so a module unload (or hot-unplug) of a working adapter permanently leaks the queues, pools, scratch, maps and both DMA tags (hundreds of KB per cycle). Teardown-mirror fix.