_PROP_ONCE_RUN sets completion flag before calling init racing concurrent first-user into NULL-deref on uninitialized rb_tree

Summary

Kernel-mode _PROP_ONCE_RUN macro (prop_object_impl.h:303) atomically sets once-flag to 1 BEFORE calling init function f(). Concurrent thread losing cmpset sees flag==1 proceeds past guard without waiting for _prop_dict_init() to complete. Losing caller enters _prop_dict_keysym_alloc or _prop_dictionary_lock operating on global _prop_dict_keysym_tree (rbt_ops still NULL) and global mutex (struct lock not yet lockinitd) causing NULL pointer dereference panic in _prop_rb_tree_find. _prop_rb_tree_find (prop_rb.c:92-93) unconditionally dereferences rbto (NULL) to load compare function pointer panicking at small near-zero address. Userspace build uses pthread_once (correct) only kernel build has this bug. In practice first proplib call occurs during single-threaded boot closing window. Race exploitable when first use deferred to multi-threaded post-boot e.g. lazily-loaded kernel module with first two ioctl invocations on different CPUs simultaneously. Impact kernel panic DoS no privilege escalation or info leak.