syncache_insert dereferences possibly-uninitialized sc2 in cache-overflow path when cachelimit=0

Summary

sc2 declared without init(:359). Cache-full branch(:377-393) searches timer queues SYNCACHE_MAXREXMTS down for non-empty, assigns sc2 only if found(:384-388). If loop completes empty -> falls through to if(sc2->sc_tp!=NULL)(:389) read of uninit ptr then syncache_drop(sc2,NULL)(:391). Unreachable in default op (cache_count>=cache_limit>0 implies entry exists). BUT boot tunable net.inet.tcp.syncache.cachelimit=0(:340-341) makes cache_count(0)>=cache_limit(0) TRUE on first SYN, all timerq empty, sc2 uninit -> panic on first remote SYN. Fix: init sc2=NULL, add null check.