ng_fec_ether_cmdmulti iterates if_multiaddrs lockless + leaks membership on partial kmalloc failure

Summary

ng_fec_ether_cmdmulti(:542): TAILQ_FOREACH over trifp->if_multiaddrs WITHOUT IF_ADDR_LOCK. List concurrently mutable (SIOCADDMULTI/SIOCDELMULTI) -> UAF on freed ifmultiaddr. Lines :548-553: if if_addmulti succeeds but kmalloc(ng_fec_mc) fails -> returns ENOMEM without recording rifma -> membership orphaned on member iface forever (set==0 cleanup only removes tracked). Fix: IF_ADDR_LOCK around iteration, if_delmulti_ifma(rifma) on kmalloc fail.