ng_fec_choose_port dereferences ether/ip/ip6 headers with no mbuf length validation

Summary

ng_fec_choose_port(:1018-1058): eh=mtod(m),ip=mtod+sizeof(ether_header),ip6=same. No m_length/m_pkthdr.len check, no m_pullup. INET/INET6 branches(:1050-1058) read ip->ip_dst/ip6_dst. Short/VLAN-tagged frame flagged INET but <14+20 contiguous -> OOB read. No VLAN/802.1Q adjustment. TX decision path only, normal IP packets long enough. Fix: validate pkthdr.len+m_pullup before deref.