amdgpu_job_submit_direct latches *fence before checking the error and leaks ownership on failure — any future caller passing an uninitialized fence gets a wild kref_get (latent error-contract defect)

Summary

ib_schedule only writes *f on success but the latch runs unconditionally, and the error return frees nothing (undocumented caller-frees contract). All 11 in-tree callers init NULL and free on error - latent defense-in-depth. Move-latch-after-error-check fix.