Forget about the ho_lchan inside the gsm_subscriber_connection in case of a handover failure, also clear the gsm_subscriber_connection pointer before the lchan is passed to the lchan_free routine.