Re: if_bge.c callout freed before allocation

Hi,

> Looking at it, I suspect there is another bug lurking. 
> bge_attach() has 14 places where it can return without
> reeaching the end.

For some drivers, the progress through the setup is tracked and the detach
or failure unwinds the successful steps.  Maybe it's worth doing something
similar in bge?  For example, src/sys/dev/ic/gem.c [1] and specifically
the GEM_ATT_* definitions, gem_detach()/gem_partial_detach().

Regards,

Julian

[1] https://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ic/gem.c?rev=1.139;content-type=text%2Fx-cvsweb-markup

--