add_entry6 null-terminates fw_in_if.name but not fw_out_if.name: kfnmatch bounded over-read

Summary

add_entry6(:851): ftmp->fw_in_if.fu_via_if.name[IP6FW_IFNLEN-1]=\0 BUT fw_out_if.fu_via_if.name never NUL-terminated. IPV6_FW_F_OIFNAME rule with non-NUL-filled name -> iface_match kfnmatch(ifu->fu_via_if.name,...)(:326) reads pattern until NUL. Over-read stays inside allocated struct ip6_fw (scans through glob/union/fw_prot/fw_nports). Rule semantics undefined. Fix: add ftmp->fw_out_if...name[IP6FW_IFNLEN-1]=\0 or validate in check_ip6fw_struct.