Commit cfa6e2c52c for qemu.org

commit cfa6e2c52ca8f756461fe41f4ce40e61a82fd914
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Wed Aug 26 19:47:32 2026 +0200

    i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails

    memory_region_find returns the memory region with an elevated
    reference count.  Drop the reference count also if the memory
    region cannot be mapped writable.

    Cc: qemu-stable@nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 9adce17262..5c3911cf9c 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -614,11 +614,13 @@ static int vapic_map_rom_writable(VAPICROMState *s)

     /* read ROM size from RAM region */
     if (rom_paddr + 2 >= memory_region_size(section.mr)) {
+        memory_region_unref(section.mr);
         return -1;
     }
     ram = memory_region_get_ram_ptr(section.mr);
     rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
     if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) {
+        memory_region_unref(section.mr);
         return -1;
     }