Bind/xfer lifecycle leaks and open race: fw_bindadd failure leaks fwb+xfer, CBIND/close free binds without their xferlist xfers, fw_open si_drv1 check-then-set race double-allocates fw_drv1

Summary

SBINDADDR failure leaks fwb+xfer; CBIND/close free binds without their xferlist xfers (~152B M_FWXFER per cycle, unbounded operator-user leak); fw_open's singleton check is an unlocked check-then-set with an M_WAITOK sleep in the window - two racing opens both allocate fw_drv1, the second close then derefs NULL si_drv1->ir. Leak hunks included in the validated DF-5413 fix.diff; open race needs a lock/cmpset.