mmc_ivars leaked on every discovery error-break of a newly-allocated card (hostile card leaks ~0.7 kB per scan)

Summary

~10 error paths break out of the discovery loop before the newly-allocated ivar is attached to a child (allocation at :1440, ownership transfer at :1704-1707): a card that passes CMD2/CMD3 then fails any subsequent command leaks one mmc_ivars per scan, recurring at boot and every resume/replug. Code-trace certain; leak-rate requires physical replug cycles - skipped per contract. track-and-free fix.