iconv_xlat16_conv dereferences d_table[c1] without NULL check after case-conversion mutates c1/c2

Summary

In iconv_xlat16_conv() after KICONV_FROM_LOWER/KICONV_FROM_UPPER case conversion at lines 149-158 (double-byte) or 172-189 (single-byte) changes c1 and c2 to lower/upper-case variant table indices code falls through to line 192 code=dp->d_table[c1][c2] without re-checking dp->d_table[c1] is non-NULL. If case-converted character maps to high-byte block with no table entries (d_table[new_c1]==NULL valid state for sparse tables) line 192 dereferences NULL immediate kernel panic. At line 142 initial lookup checks dp->d_table[c1]&&dp->d_table[c1][c2] before entering double-byte branch. But lines 156-158 mutate c1/c2 based on towlower/towupper result. NEW c1 may index completely different d_table[] slot NOT checked. Single-byte branch line 163 checks d_table[c1] non-NULL but lines 187-189 mutate c1 via C2I1(ctmp<<8). Both paths converge at line 192 code=dp->d_table[c1][c2] with no NULL guard on d_table[c1] after mutation. Check at line 193 if(!code) only fires AFTER dereference already occurred. Reachable via unprivileged kern.iconv.add sysctl registering crafted xlat16 _wctype table where entry has XLAT16_HAS_LOWER_CASE with lowercase code C2I1 decomposition pointing to absent block. Impact: deterministic kernel panic local DoS.