_prop_object_copyout() leaks the vm_mmap()ed user region when copyout() fails (no vm_map_remove on the error path)

Summary

On vm_mmap success but copyout failure (same-process racing munmap between the steps, or fault-in failure under pressure) the anon mapping is left in the caller's map: one leaked page-sized user mapping per failed call. Self-inflicted or pressure-induced; defense-in-depth. vm_map_remove-on-error fix.