Unsynchronized sc->inq/outq between hard ISR and netgraph forward: ifqueue corruption / UAF

Summary

bt3c_intr hard-ISR(:771) -> bt3c_receive IF_ENQUEUE(&sc->inq)(:939). bt3c_swi_intr(SWI_TTY:963) -> ng_send_fn -> bt3c_forward IF_DEQUEUE(&sc->inq)(:1017). IF_ENQUEUE/DEQUEUE macros(if_var.h:484-510) are LOCK-FREE linked list manipulation. attach(:609-675) inits NO ifqueue lock. Hard ISR explicitly outside netgraph node serialization. Hard IRQ preempts SWI -> ISR IF_ENQUEUE mid-IF_DEQUEUE -> list corruption, ifq_tail/ifq_head dangling at freed mbuf -> UAF. Same pattern outq(:566 vs :1060/:1081). Remote-ish BT RF trigger but gated on rare 3CRWB609 PCMCIA hardware. Fix: move IF_ENQUEUE to SWI or spinlock all queue ops.