All but two knote_drop() calls are preceeded by:
if ((kn->kn_status & KN_DETACHED) != 0) kn->kn_fop->f_detach(kn);
One of them is the case where f_attach returns an error. In this case we
free the knote without detaching it, so the attach routine is not
allowed to return an error after adding the knote to a knlist.
The other case is knlist_cleardel(), which manually dequeues the knote
(and sets KN_DETACHED) by calling knlist_remove_kq() immediately before
calling knote_drop().
Therefore, move the detach operation into knote_drop().