usb_open() error path after successful fifo opens leaks the opened fifos with curr_cpd pointing at the freed cpd (latent — devfs_set_cdevpriv cannot currently fail for a fresh open)

Summary

If devfs_set_cdevpriv failed, usb_open kfrees cpd without fifo_close - f->curr_cpd dangles and the endpoint is EBUSY forever; a groomed replacement cpd would pointer-match and pass the ownership check. Currently unreachable (fresh-open cdevpriv cannot fail). Close-fifos-then-free hardening.