ifnet locking-contract violation and stored-pointer UAF on member ifnets

Summary

if_var.h:894-896 mandates ifunit() requires ifnet_lock held + returned ifp only accessed under lock. ng_fec_addport/delport call ifunit(:370,:481) NO ifnet_lock, store ifp in fec_portlist->fec_if(:450). Deref indefinitely from ng_fec_tick(callout :687-691 1Hz), ng_fec_input(netisr RX :885-888), ng_fec_start(tx :1066-1095). If member iface detached/destroyed -> ifnet freed+reused -> UAF via stored fec_if. 1Hz callout makes race practical. Fix: ifunit_ref or ifnet_departure eventhandler + ifnet_lock around derefs.