QEMU fixes virtio-scsi leak that could exhaust host memory

QEMU has fixed a reference-count leak in its virtio-scsi device that let a guest exhaust host memory by submitting repeated batches of malformed commands.

The flaw, CVE-2026-61476, sat in the path that cleans up prepared requests after a bad element in the same batch. Preparation left each unsubmitted SCSIRequest with two references, but the cleanup path dropped only one. The orphaned objects accumulated without bound.

Michael S. Tsirkin's fix drops the second reference and clears the HBA private pointer first, and introduces a small helper so other SCSI host adapters follow the same pattern instead of open-coding the detach-and-unref sequence.

Guests that can drive virtio-scsi were able to force unbounded host memory growth through nothing more exotic than invalid request batches. The change closes that avenue.