Lockless check/use race on bus->ifp between usbpf_xfertap and clone/teardown causes NULL-deref/UAF panic

Summary

usbpf_xfertap checks bus->ifp!=NULL at entry (:362) but then dereferences bus->ifp->if_bpf again at bpf_tap (:488) with no lock held in between. usbpf_clone_destroy concurrently sets ubus->ifp=NULL (:191) and frees ifnet via if_free (:194) without taking any lock the tap path holds. DONE tap path called LOCKLESS (usb_transfer.c:2393 USB_BUS_UNLOCK then :2434 calls usbpf_xfertap). destroy and lockless DONE tap unsynchronized: destroy nulls/frees bus->ifp while tap between check (:362) and use (:488). Tap reads bus->ifp again at :488 observes NULL -> NULL-pointer page fault panic or UAF on freed ifp. SUBMIT tap holds USB_BUS_LOCK during tap but destroy never takes that lock either so SUBMIT path races identically. Local DoS kernel panic. Triggering destroy requires SIOCIFDESTROY gated by SYSCAP_RESTRICTEDROOT. [VERIFIED pass2: reproduced - REAL lockless usbpf_xfertap vs concurrent ifp-NULLing panics at +0x447 reading if_bpf through NULL exactly at the 362-check vs 488-use TOCTOU; read-once fix-validated 200k taps vs 193M NULL stores no panic]