cttyioctl forwards ioctls to ttyvp without vnode reference (UAF race)

Summary

cttyioctl reads ttyvp=cttyvp(p) under p_token(:238), releases token(:262), calls VOP_IOCTL(ttyvp,...)(:264) with NO vget/vref. Writers (ttyclosesession tty.c:334, fdrevoke kern_descrip.c:2031) use proc_token != p_token. Session ref can be vrele-ed during VOP_IOCTL -> UAF/reclaimed vnode. cttyread/cttywrite correctly use vget(:199,:223) but ioctl does not.