Thanks, does this help? (I assume removing the free would work but not be ideal)
I think the difference is that firmware_*'s allocator is kmem_alloc which should be kmem_free'd, not regular free. Index: rt2860.c =================================================================== RCS file: /cvsroot/src/sys/dev/ic/rt2860.c,v retrieving revision 1.26 diff -u -r1.26 rt2860.c --- rt2860.c 23 May 2017 02:19:14 -0000 1.26 +++ rt2860.c 20 Jul 2017 12:42:29 -0000 @@ -466,7 +466,7 @@ } if (sc->ucode != NULL) - free(sc->ucode, M_DEVBUF); + firmware_free(sc->ucode, sc->ucsize); return 0; }