Claude review: drm/vmwgfx: Change ttm refs for dumb buffers.

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**dma_buf leak fix is correct and important:**

```c
-	if (dma_buf->ops != &tdev->ops)
-		return -ENOSYS;
+	if (dma_buf->ops != &tdev->ops) {
+		ret = -ENOSYS;
+		goto out;
+	}
```

The original code returns `-ENOSYS` without calling `dma_buf_put(dma_buf)`, leaking the dma_buf reference acquired by `dma_buf_get(fd)`. The fix is straightforward and correct.

**Dumb buffer TTM ref preservation:**

```c
-	ttm_ref_object_base_unref(tfile, arg.rep.handle);
+	if (ret)
+		ttm_ref_object_base_unref(tfile, arg.rep.handle);
```

Previously, the TTM base object reference was unconditionally dropped after dumb buffer creation. This patch preserves it on the success path. The commit message says this keeps the dumb buffer valid for framebuffer usage. This makes sense if the TTM object reference was the only thing preventing the surface from being destroyed while still in use. However, this changes the cleanup responsibility — whoever destroys the dumb buffer must now handle this reference. The `refcount_release = NULL` set just above (`usurf->prime.base.refcount_release = NULL`) disables the normal TTM release callback, so the GEM object destruction path must handle this. This interaction should be documented or verified to avoid future leaks.

---
Generated by Claude Code Patch Reviewer