We already have the number of available interfaces in the configuration descriptor, so use it to free the array.
ok? Index: usb_subr.c =================================================================== RCS file: /cvs/src/sys/dev/usb/usb_subr.c,v retrieving revision 1.140 diff -u -p -r1.140 usb_subr.c --- usb_subr.c 14 Nov 2018 17:00:33 -0000 1.140 +++ usb_subr.c 14 Nov 2018 17:27:26 -0000 @@ -648,7 +648,7 @@ usbd_set_config_index(struct usbd_device nifc = dev->cdesc->bNumInterface; for (ifcidx = 0; ifcidx < nifc; ifcidx++) usbd_free_iface_data(dev, ifcidx); - free(dev->ifaces, M_USB, 0); + free(dev->ifaces, M_USB, nifc * sizeof(*dev->ifaces)); free(dev->cdesc, M_USB, UGETW(dev->cdesc->wTotalLength)); dev->ifaces = NULL; dev->cdesc = NULL; @@ -775,8 +775,8 @@ usbd_set_config_index(struct usbd_device /* Allocate and fill interface data. */ nifc = cdp->bNumInterface; - dev->ifaces = mallocarray(nifc, sizeof(struct usbd_interface), - M_USB, M_NOWAIT | M_ZERO); + dev->ifaces = mallocarray(nifc, sizeof(*dev->ifaces), M_USB, + M_NOWAIT | M_ZERO); if (dev->ifaces == NULL) { err = USBD_NOMEM; goto bad; @@ -1406,7 +1406,7 @@ usb_free_device(struct usbd_device *dev) nifc = dev->cdesc->bNumInterface; for (ifcidx = 0; ifcidx < nifc; ifcidx++) usbd_free_iface_data(dev, ifcidx); - free(dev->ifaces, M_USB, 0); + free(dev->ifaces, M_USB, nifc * sizeof(*dev->ifaces)); } if (dev->cdesc != NULL) free(dev->cdesc, M_USB, UGETW(dev->cdesc->wTotalLength));