Claude review: accel/habanalabs: fix refcount leak in hl_direct_io()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Verdict: Correct fix, good for merge.**

The bug analysis in the commit message is accurate:

1. `hl_dio_get_iopath()` (line 149-168) calls `hl_ctx_get(ctx)` at line 162 and increments `inflight_ios` at line 154 on success.
2. `hl_dio_put_iopath()` (line 170-176) is the matching cleanup — it calls `hl_ctx_put(ctx)` and decrements `inflight_ios`.
3. Without this fix, the `vzalloc()` failure path returned directly:

```c
if (!io->bv)
    return -ENOMEM;
```

This leaked the context reference and inflight I/O count.

4. The fix correctly adds the cleanup call before the early return:

```c
if (!io->bv) {
    hl_dio_put_iopath(io->f.ctx);
    return -ENOMEM;
}
```

**Minor note on style:** The commit message says "Fix this by jumping to the cleanup label on error" but the actual patch adds an inline `hl_dio_put_iopath()` call rather than a `goto cleanup`. The code is correct either way — the `cleanup` label at line 274 does `vfree(io->bv)` followed by `hl_dio_put_iopath()`, and since `io->bv` is NULL at this point `vfree(NULL)` is a no-op, so a `goto cleanup` would also work. However, the **commit message is misleading** — it describes a `goto cleanup` approach but the implementation uses a direct inline call. The author should fix the commit message to match the implementation.

**Tags:** The `Fixes:` tag and `Cc: stable` are appropriate. The fix is minimal and backport-safe.

---
Generated by Claude Code Patch Reviewer