Missing break between SIOCSIFDESCR and SIOCSIFFLAGS: fall-through reinterprets description length as interface flags

Summary

SIOCSIFDESCR case ends at :2132 kfree(odescrbuf) with NO break before case SIOCSIFFLAGS at :2134. Fall-through: ifr_buffer.length aliases ifr_flags via ifr_ifru union(if.h:259-261). ifconfig em0 description a (length 2) -> new_flags=2 -> clears IFF_UP -> interface goes DOWN. Length 256 sets IFF_PROMISC. Privileged but bypasses SIOCSIFFLAGS gate. ifconfig -desc already exhibits this bug operationally.