cdcacm_unbind leaks write request objects. This arises due to freeing the

bulk IN endpoint before the loop that frees the requests via cdcasm_freereq.
That function checks the parameters and skips the freeing if either is NULL.
Freeing the bulk IN enpoint will cause the first param to be NULL, thereby
bypassing the free operation.  To fix, I moved the release of the bulk IN
endpoint until after to loop (much as was the case for the OUT and read
requests, which did not exhibit the problem).