df-memleak: expose memleak error and fix with 'notleak'

These get cleaned up, but memleak catches them anyway? I'm not really
sure what's going on here.

lightningd/dual_open_control.c

@@ -546,7 +546,7 @@ static void rbf_channel_hook_cb(struct rbf_channel_payload *payload STEALS)
 	}
 
 	/* Update channel with new open attempt. */
-	channel->open_attempt = new_channel_open_attempt(channel);
+	channel->open_attempt = notleak(new_channel_open_attempt(channel));
 	msg = towire_dualopend_got_rbf_offer_reply(NULL,
 						   payload->our_funding,
 						   payload->psbt);
@@ -1196,7 +1196,6 @@ wallet_commit_channel(struct lightningd *ld,
 				channel->last_tx,
 				channel->last_sig);
 	wallet_inflight_add(ld->wallet, inflight);
-	channel->open_attempt = NULL;
 
 	return inflight;
 }
@@ -1587,6 +1586,19 @@ static void rbf_got_offer(struct subd *dualopend, const u8 *msg)
 		return;
 	}
 
+	/* There's currently another attempt in progress? */
+	if (channel->open_attempt) {
+		log_debug(channel->log,
+			  "RBF attempted while previous attempt"
+			  " is still in progress");
+
+		subd_send_msg(dualopend,
+			      take(towire_dualopend_fail(NULL,
+					"Error. Already negotiation"
+					" in progress")));
+		return;
+	}
+
 	assert(channel_id_eq(&channel->cid, &payload->channel_id));
 	/* Fill in general channel info from channel */
 	payload->peer_id = channel->peer->id;
@@ -1886,7 +1898,7 @@ json_openchannel_bump(struct command *cmd,
 				    " RBF attempt");
 
 	/* Ok, we're kosher to start */
-	channel->open_attempt = oa = new_channel_open_attempt(channel);
+	channel->open_attempt = oa = notleak(new_channel_open_attempt(channel));
 	oa->funding = *amount;
 	oa->cmd = cmd;
 	oa->our_upfront_shutdown_script
@@ -2322,9 +2334,6 @@ static void handle_commit_received(struct subd *dualopend,
 	struct channel_inflight *inflight;
 	struct command *cmd = oa->cmd;
 
-	/* We clean up the open attempt regardless */
-	tal_steal(tmpctx, oa);
-
 	if (!fromwire_dualopend_commit_rcvd(tmpctx, msg,
 					    &channel_info.their_config,
 					    &remote_commit,
@@ -2349,6 +2358,7 @@ static void handle_commit_received(struct subd *dualopend,
 		channel_internal_error(channel,
 				       "Bad WIRE_DUALOPEND_COMMIT_RCVD: %s",
 				       tal_hex(msg, msg));
+		channel->open_attempt = tal_free(channel->open_attempt);
 		return;
 	}
 
@@ -2365,6 +2375,8 @@ static void handle_commit_received(struct subd *dualopend,
 						  type_to_string(tmpctx,
 							 struct node_id,
 							 &channel->peer->id));
+			channel->open_attempt
+				= tal_free(channel->open_attempt);
 			return;
 		}
 
@@ -2389,6 +2401,8 @@ static void handle_commit_received(struct subd *dualopend,
 					       type_to_string(tmpctx,
 							      struct channel_id,
 							      &channel->cid));
+			channel->open_attempt
+				= tal_free(channel->open_attempt);
 			return;
 		}
 
@@ -2400,7 +2414,6 @@ static void handle_commit_received(struct subd *dualopend,
 
 	} else {
 		assert(channel->state == DUALOPEND_AWAITING_LOCKIN);
-		assert(oa);
 
 		if (!(inflight = wallet_update_channel(ld, channel,
 						       remote_commit,
@@ -2418,7 +2431,8 @@ static void handle_commit_received(struct subd *dualopend,
 							  tmpctx,
 							  struct channel_id,
 							  &channel->cid));
-
+			channel->open_attempt
+				= tal_free(channel->open_attempt);
 			return;
 		}
 
@@ -2430,6 +2444,8 @@ static void handle_commit_received(struct subd *dualopend,
 			channel_err_broken(channel,
 					   "Unexpected COMMIT_RCVD %s",
 					   tal_hex(msg, msg));
+			channel->open_attempt
+				= tal_free(channel->open_attempt);
 			return;
 		}
 		response = json_stream_success(oa->cmd);
@@ -2447,6 +2463,8 @@ static void handle_commit_received(struct subd *dualopend,
 			/* FIXME: also include the output as address */
 		}
 
+		channel->open_attempt
+			= tal_free(channel->open_attempt);
 		was_pending(command_success(cmd, response));
 		return;
 	case TX_ACCEPTER:
@@ -2459,6 +2477,9 @@ static void handle_commit_received(struct subd *dualopend,
 		payload->channel = channel;
 		payload->psbt = clone_psbt(payload, inflight->funding_psbt);
 
+		channel->open_attempt
+			= tal_free(channel->open_attempt);
+
 		/* We don't have a command, so set to NULL here */
 		payload->channel->openchannel_signed_cmd = NULL;
 		/* We call out to hook who will