lagg_input dereferences ifp->if_lagg unlocked: UAF during concurrent port detach

Summary

lagg_input(:1442-1456) reads lp=ifp->if_lagg then sc=lp->lp_softc with NO lock and NO NULL check before taking LAGG_RLOCK(sc)(:1448). Detach path(lagg_port_destroy under WLOCK) sets ifp->if_lagg=NULL(:766) and kfrees lp(:805). RX on another CPU already past ether_input type check can deref freed lp->lp_softc -> UAF or NULL deref -> panic. Same pattern in lagg_port_output(:911). Low confidence: ifnet departure ordering partially mitigates.