nd6_sysctl_drlist/prlist iterate defrouter/prefix lists without nd6_mtx: UAF race with RA processing

Summary

nd6_sysctl_drlist(:2168-2169) and nd6_sysctl_prlist(:2209-2254) iterate global lists WITHOUT nd6_mtx. RA processing (nd6_rtr.c defrtrlist_del/update/prelist_remove) modifies same lists under nd6_mtx on netisr0. Multi-CPU: sysctl handler derefs freed entry mid-iteration. Contrast: ioctl SIOCGDRLST(:1441) correctly holds mtx. Remote: RA flood + unpriv sysctl read -> UAF panic/info leak.