Kernel stack info-leak via uninitialized redstats[3] array in hfsc_getqstats copyout

Summary

hfsc_getqstats(:293-330): struct hfsc_classstats stats on stack NOT zero-initialized. get_class_stats fills all fields EXCEPT trailing redstats red[3] — only written for Q_RED/Q_RIO ifdef(:1696-1702). Default Q_DROPTAIL class: red[0..2] untouched. Full struct copyout to user at :327 leaks ~3*sizeof(redstats) stale kernel stack bytes. Privileged PF queue-stats ioctl. KASLR bypass seed.