wifi: airoc: TX net_buf is leaked when whd_network_send_ethernet_data() fails #113303

Describe the bug

airoc_mgmt_send() (the L2 transmit callback in
drivers/wifi/infineon/airoc_wifi.c) allocates a net_buf from the driver's
fixed packet pool for every outbound packet, but does not release it if the send
fails synchronously:

/* Allocate Network Buffer from pool with Packet Length + Data Header */
ret = airoc_wifi_host_buffer_get((whd_buffer_t *)&buf, WHD_NETWORK_TX,
                                 pkt_len + sizeof(data_header_t), 0);
...
ret = whd_network_send_ethernet_data(airoc_if, (void *)buf);
if (ret != CY_RSLT_SUCCESS) {
        LOG_ERR("whd_network_send_ethernet_data failed");
        ...
        return -EIO;   /* buf is never released */
}

WHD only takes ownership of the buffer when the send succeeds — on a synchronous
failure it does not consume it, so the buffer must be released by the caller.
Since airoc_mgmt_send() just logs and returns -EIO,
airoc_wifi_buffer_release() is never called for that buffer and it is never
returned to the pool.

The pool is small and fixed: AIROC_WIFI_PACKET_POOL_COUNT is
AIROC_WIFI_TX_PACKET_POOL_COUNT (10) + AIROC_WIFI_RX_PACKET_POOL_COUNT (10)
= 20 buffers, and it backs WHD's whd_host_buffer_get callback for both
directions. Every failed transmit permanently consumes one buffer. After enough
send failures the pool is exhausted, airoc_wifi_host_buffer_get() starts
returning WHD_BUFFER_ALLOC_FAIL, and both transmit and WHD's internal (RX-side)
buffer allocation fail from then on — the interface stops passing traffic and
does not recover without a reboot.

This is reachable in ordinary operation: transmits keep being attempted while the
link is down or unstable (TCP retransmissions, ARP, etc.), and each failing send
leaks another buffer.

Expected behavior

On a synchronous whd_network_send_ethernet_data() failure, airoc_mgmt_send()
should release the buffer it allocated (airoc_wifi_buffer_release(buf, WHD_NETWORK_TX)) before returning the error, so the buffer goes back to the pool
and repeated send failures do not degrade the interface.

Additional issue

In the same driver, airoc_mgmt_disconnect() calls k_sem_give(&data->sema_common)
in the whd_wifi_leave() failure branch and then again unconditionally at the end
of the function. sema_common is a binary semaphore
(k_sem_init(&data->sema_common, 1, 1)), so the duplicate give releases the lock
earlier than intended on that path. The extra give should be removed.

Affected code

drivers/wifi/infineon/airoc_wifi.c — airoc_mgmt_send(), airoc_mgmt_disconnect().