DF-0161
m_tag_copy_chain reverses tag order: tprev=t misplaced inside else branch
Summary
m_tag_copy_chain(:376-381): tprev=t is inside else branch. After first SLIST_INSERT_HEAD, tprev never updated -> every tag inserted at head -> destination reversed. SLIST_INSERT_AFTER is dead code. Upstream KAME/FreeBSD places tprev=t outside if/else. Impact: tag ordering divergence, could reorder security tags (PF/IPFW).