ips_ioctl_cmd ENOMEM error path feeds a failed bus_dmamem_alloc result into bus_dmamem_free — contigfree(NULL)/kfree(NULL) corrupts kernel_map or panics

Summary

The goto-exit on alloc failure unconditionally frees an allocation that never happened: map==NULL -> kfree(NULL) panic; map==(void*)-1 -> contigfree(NULL,4096) -> kmem_free(kernel_map,0,4096) resource-map corruption. Root-only device + needs a 4KB contigmalloc failure. Return-directly-after-tag-destroy fix. Same pattern at ips_commands.c:307/326 (routed).