run_stop early-return on failed USB read skips run_unsetup_tx_list; the next run_init_locked->run_setup_tx_list memsets the queues, orphaning all queued mbufs and node references (repeatable leak with a wedged/hostile device)

Summary

Three early returns on run_read failure skip the ONLY release of pending data->m/data->ni on the tx rings; next ifconfig up's run_setup_tx_list memsets the queues discarding the pointers wholesale - each up/down cycle on a wedged/hostile device leaks the whole tx backlog -> mbuf/node exhaustion DoS. goto-teardown fix.