nd6_ra_input mutates per-interface ND timing state (reachable/retrans/chlim/linkmtu) without nd6_mtx: data race

Summary

nd6_ra_input(:272-284,:351-379) modifies ndi->basereachable/reachable/recalctm/retrans/chlim/linkmtu with NO nd6_mtx while other paths (nd6_setmtu0, timer, sysctl, nd6.c:461/692) access under mtx. Concurrent RA on multiple CPUs interleaves writers -> inconsistent ND timing/MTU state. No memory safety, defense-in-depth.