setsockopt(IP_OPTIONS) overwrites copyin error: parses stale mbuf data as IP options on copyin failure

Summary

ip_ctloutput IP_OPTIONS(:1097-1118): error=sopt_to_kbuf(...); error=ip_pcbopts(...). Second assignment overwrites first error. If sopt_to_kbuf fails (EFAULT unmapped ptr), MGET buffer NOT zeroed, ip_pcbopts parses stale heap data as IP options. If stale bytes satisfy loose syntax (mult4, valid LSRR/SSRR), stored in inp_options, emitted on subsequent packets. Probabilistic kernel heap info leak via IP options. Fix: check error before ip_pcbopts; use M_DONTWAIT|M_ZERO.