altq_etherclassify NULL-pointer dereference: mbuf chain walk advances to m_next without NULL check

Summary

altq_etherclassify(:927-930): while(m->m_len<=hlen){hlen-=m->m_len; m=m->m_next;} advances to m_next without checking m!=NULL. If chain ends before hlen consumed (m_next==NULL for last mbuf + preceding m_len exactly equals remaining hlen) -> next iteration evaluates m->m_len on NULL -> panic. Comment(:932-936) "ip header not in single mbuf... todo use m_pulldown" concedes incomplete. Trigger: ALTQ enabled egress + packet first mbuf m_len==14 or 22 with no m_next. Kernel panic local/transitive DoS.