SLIOCSUNIT struct-assigns embedded callout nodes: callout queue corruption

Summary

SLIOCSUNIT(:365-372): *tmpnc=*nc *nc=*sc swap struct-assigns entire sl_softc including embedded callout sc_oftimeout/sc_katimeout(if_slvar.h:66-67). If keepalive/outfill armed first(callout_reset before SLIOCSUNIT) callouts linked into scheduling queue -> copying callout node to new address duplicates internal pointers -> queue corruption -> UAF/panic. Requires root+unusual sequence(arm before unit change). Fix: callout_stop both before swap exclude callout members callout_init after.