PF_LOCAL sockaddr unparse: sun_len<pathoff underflow -> giant bcopy -> stack OOB write (DF-0509 v1 twin)

Summary

ng_ksocket_sockaddr_unparse(:321-339) PF_LOCAL: pathlen=sun->sun_len-pathoff(pathoff=2). NO validation sun_len>=pathoff. If sun_len<2: pathlen negative int -> bcopy(sun->sun_path, pathbuf, pathlen)(:331) interprets as size_t~2^64 -> massive stack OOB write into 256-byte pathbuf + OOB read from sun_path. pathbuf[pathlen]=\0(:332) writes at negative index. Identical to DF-0509(ng7). Generic helper ng_parse_generic_sockdata_getLength(:169-177) DOES guard this (returns 0 when sa_len<SADATA_OFFSET) but unparse omits guard. Medium (not High like ng7) because v1 ksocket is less commonly deployed and kernel-produced sockaddrs always have valid sun_len. Fix: pathlen=(sun_len<pathoff)?0:sun_len-pathoff.