sta_iterate drops table lock across user callback: entry can be freed concurrently use-after-free

Summary

sta_iterate(:1413-1424): walks under iter+table lock, then UNLOCK before (*f)(arg,&se->base), goto restart re-acquire. During unlocked callback entry has no ref/lock. Concurrent adhoc_age/sta_flush_table frees se -> callback touches freed memory -> UAF. Iter lock does not serialize against age/flush paths.