Default netmap ioctl passthrough fabricates zeroed stack struct socket passed to ifioctl

Summary

Default ioctl case(:1488-1506) builds struct socket so on stack, bzeros it, resolves arbitrary interface by name, calls ifioctl(&so,cmd,ap->a_data,ap->a_cred)(:1502). Local comment flags hazard "so->so_proto not null." Zeroed socket -> any ifioctl/driver ioctl path derefing so_proto/so_options hits NULL -> potential kernel panic. cmd+interface attacker-chosen from nmreq. Priv checks use ap->a_cred so no priv-esc. 0660 root:wheel gating.