hfsc_dequeue panic() on NULL from hfsc_getq: kernel-panic DoS if backlogged class queue drains underneath scheduler

Summary

hfsc_dequeue(:827-829): m=hfsc_getq(cl); if(m==NULL) panic("hfsc_dequeue:"). RED/rio_getq can return NULL if marking drops head while qlen still reports non-empty. Subsequent !qempty check(:839) reads same possibly-stale qlen. If invariant violated (RED early-drop, race window) -> kernel panic. Should set_passive(cl)+goto done instead. Narrow trigger requires privileged altq config + timing.