DF-3501 leak sample (kernel heap pointer disclosed as fec interface MAC)

Run 1 (this run, gif1->gif_psrc at time of addport):
  ifconfig fec1 | grep ether -> ether f0:2d:0a:4f:00:f8
  bytes = f0 2d 0a 4f 00 f8  (little-endian low 6 bytes of the pointer)
  reconstructed pointer = 0x0000_f800_4f0a_2df0  -> 0xfffff8004f0a2df0
  pattern: 0xfffff800xxxxxxxx = DFly kernel heap (KVA) address range,
  consistent with gif_softc.gif_psrc pointing at a kmalloc'd sockaddr.

Cross-checks in the same run:
  fec0 (vtnet0 first member) MAC  = 52:54:00:12:34:56  = vtnet0's real MAC
  -> the MAC is provably sourced from member_ifp + 928 (ac_enaddr slot),
     i.e. past the end of a non-arpcom member's ifnet allocation.

  dumpif before: lo0 tail+0/+16 = 0 / 0
  dumpif after add lo0:         tail+0 = 0000563412005452 (= vtnet0 MAC),
                                tail+16 = fffff8004f1ae2e0 (= fec0 ng_node ptr)