config_red kfrees caller-owned possibly-embedded struct on red_lookup_depth==0 path: latent UAF — same as v1

Summary

config_red(:1364-1368) when red_lookup_depth==0: kfree(x,M_DUMMYNET)+return EINVAL. x can be &pipe->fs embedded in dn_pipe. set_fs_parms ignores return. Currently dead: red_lookup_depth CTLFLAG_RD sysctl default 256. Same latent UAF as DF-0377 (v1). Fix: dont free x; return EINVAL; let caller handle.