netgraph message leak on ioctl timeout-vs-response race

Summary

Synchronous ioctl handlers(:910-915,:965-969,:1038-1043,:1099-1104,:1378-1383): lksleep with timeout. If timeout fires same instant ng_btsocket_l2cap_raw_input(:418-421) matches token+sets pcb->msg+wakeup, ioctl thread observes non-zero lksleep return, executes pcb->token=0;break WITHOUT consuming pcb->msg. pcb->msg leaked (next call sets NULL freeing nothing). Each msg sizeof(ng_mesg)+arglen from M_NETGRAPH_MSG. Slow kmem leak / local DoS. Fix: NG_FREE_MSG(pcb->msg) on timeout path.