fix for DF-3163: FIONREAD on an O_RDWR fifo descriptor always returned 0

Verified on the audit QEMU guest (see VERDICT.md in this directory).

--- a/sys/vfs/fifofs/fifo_vnops.c	2026-09-07 10:23:09.494800007 +0000
+++ b/sys/vfs/fifofs/fifo_vnops.c	2026-09-07 10:23:09.514799742 +0000
@@ -448,7 +448,8 @@
 		if (error)
 			return (error);
 	}
-	if (ap->a_fflag & FWRITE) {
+	/* FIONREAD is only meaningful on the read side */
+	if ((ap->a_fflag & FWRITE) && ap->a_command != FIONREAD) {
 		filetmp.f_data = vp->v_fifoinfo->fi_writesock;
 		lwkt_gettoken(&vp->v_token);
 		error = soo_ioctl(&filetmp, ap->a_command, ap->a_data,