Some observations while reading through this code:

---

request_new has a:
  if (device == NULL)
                goto out;

but then
out:
        g_object_unref (device);


thats not going to go well if device is ever actually NULL.

Also, all these early exists can lead to req->id being NULL in the returned request. From what I can see, the struct gets stuffed into priv->array_requested anyway, and then later you run remove_ignored over it, which does

 ret = g_pattern_match_simple (ignored[j], req->id);

which is not going to end well if req->id is NULL.

Remember, every gsd crash is a fail whale waiting to happen...

---
device_rebind:

I also notice that you do:

        command = g_strdup_printf ("pkexec %s %s",
                                   GSD_UPDATES_FIRMWARE_DEVICE_REBIND_PROGRAM,
                                   string->str);

Thats convenient, but should generally be avoided. Just stuff your arguments into an argv[], no need to convert the string array you already have into a commandline only to have it be parsed again, with the risk of that parsing going wrong...

---
I think all the NotifyNotification objects that are created in various places are leaked ? From my reading of the libnotify code, you have to connect to ::closed and unref the notification there - unfortunately, libnotify doesn't keep a ref of its own...


---
        syspath = g_strjoin (NULL, "/sys", symlink_path, NULL);

is a little weird. Why not just g_strconcat ("/sys", symlink_path, NULL); ?

The entire code around it is odd, you first concatenate this path, only to split it into segments, and then concatenate it again, multiple times...

Anyway, 

        for (i=len; i>1; i--) {
                split[i] = NULL;

Makes it so that split[i] is leaked when you later do

        g_strfreev (split);