ToUserDevice: fix memory leak in stream mode

In stream mode, we support partial reads.  If a packet is not fully read, we
set f->p to be the left-overs.  However, if we do not finish reading the
packet prior to close, it is leaked.  Since the pointer is a member of
file_priv, it should be killed in dev_release.