Wrong-pointer kfree in DIOCADDADDR error path frees framework pointer instead of allocated pooladdr

Summary

DIOCADDADDR error path(:2169) kfree(ap,M_PFPOOLADDRPL) — ap is the framework-owned dev_ioctl_args pointer NOT the allocated pa. Sibling correct path at :2178 uses pa. Calling kfree on non-heap pointer corrupts slab metadata or panics. Also leaks allocated pa every iteration. Root-only /dev/pf 0600.