Fix for DF-2779: snapshot mq_sig_notify.sigev_signo under mq_mtx in mq_send1().

--- sys_mqueue.c	2026-09-01 04:01:55.500648734 +0000
+++ sys_mqueue.2779.only	2026-09-01 04:03:50.167194127 +0000
@@ -788,6 +788,7 @@
 	struct mq_msg *msg;
 	struct mq_attr *mqattr;
 	struct proc *notify = NULL;
+	int notify_signo = 0;
 	/*ksiginfo_t ksi;*/
 	size_t size;
 	int error;
@@ -875,6 +876,7 @@
 	if (mqattr->mq_curmsgs == 0 && mq->mq_notify_proc &&
 	    (mqattr->mq_flags & MQ_RECEIVE) == 0 &&
 	    mq->mq_sig_notify.sigev_notify == SIGEV_SIGNAL) {
+		notify_signo = mq->mq_sig_notify.sigev_signo;
 		/* Initialize the signal */
 		/*KSI_INIT(&ksi);*/
 		/*ksi.ksi_signo = mq->mq_sig_notify.sigev_signo;*/
@@ -902,7 +904,7 @@
 		fdrop(fp);
 		/* Send the notify, if needed */
 		/*kpsignal(notify, &ksi, NULL);*/
-		ksignal(notify, mq->mq_sig_notify.sigev_signo);
+		ksignal(notify, notify_signo);
 		PRELE(notify);
 	} else {
 		lockmgr(&mq->mq_mtx, LK_RELEASE);