icmp6_redirect_output leaks uninitialized mbuf heap bytes in padded redirected-header option

Summary

icmp6_redirect_output(:2567-2573) pads quoted packet to 8-byte boundary by extending m0->m_len WITHOUT zeroing the new bytes. M_TRAILINGSPACE cluster memory beyond original packet never initialized (leftover from prior mbuf reuse). Option length recomputed from extended m0. Stale heap bytes checksummed+transmitted on link. On-link IPv6 peer of router captures ND_REDIRECT -> up to 7 bytes cross-tenant heap leak.