correctly decrement the C_SCSIXFER reference count in wdc_xfer flags
if the ata stack xfer free path is called before teh scsi xfer free
path. this fixes a leak.

in the vast majority of uses (eg, filesystems mounted on cd(4) via
atapiscsi(4)) the scsi xfer free is always done first. however, if
you're doing ioctls (eg, cdio(1)), the scsi ref is held over to the
ioctl completion path, so the ata xfer free happens first.

problem found by patrick keshishian who did some excellent work
debugging this and providing the right fix for it.

Index: wdc.c
===================================================================
RCS file: /cvs/src/sys/dev/ic/wdc.c,v
retrieving revision 1.126
diff -u -p -r1.126 wdc.c
--- wdc.c	14 Sep 2014 14:17:25 -0000	1.126
+++ wdc.c	29 Sep 2014 00:01:35 -0000
@@ -1974,7 +1974,10 @@ wdc_free_xfer(struct channel_softc *chp,
 	s = splbio();
 	chp->ch_flags &= ~WDCF_ACTIVE;
 	TAILQ_REMOVE(&chp->ch_queue->sc_xfer, xfer, c_xferchain);
-	put = !ISSET(xfer->c_flags, C_SCSIXFER);
+	if (ISSET(xfer->c_flags, C_SCSIXFER))
+		CLR(xfer->c_flags, C_SCSIXFER);
+	else
+		put = 1;
 	splx(s);
 
 	if (put)