640KB kernel heap leak per interface down/up cycle: urtwn_stop never frees rx/tx lists while urtwn_init unconditionally re-allocates (plus detach-side leak of queued TX mbufs)

Summary

init kmallocs 64x8KB + 8x16KB every !RUNNING->init transition but stop never frees the lists (only detach does) - every ifconfig down/up orphans 655,360 bytes of M_USBDEV heap; failed-init retries leak identically. Secondary: free_list frees dp->buf and drops dp->ni but never m_freem(dp->m) - TX frames stranded in sc_tx_pending leak their mbufs at detach. Deterministic, no race. free-lists-in-stop + m_freem-in-free_list fix.