X_ipip_input reads viftable/last_encap_vif without mroute_token: race with vif teardown

Summary

X_ipip_input(:1709) remote IPIP packets: iterates viftable, mutates last_encap_vif cache, derefs v_ifp with NO token. del_vif/MRT_DONE bzero+reset under token. Race: remote IPIP during vif teardown -> NULL ifp deref or stale vif access. Requires active multicast routing.