Sensitive key material left on kernel stack across multiple paths

Summary

Poly1305 one-time key poly_key[32] generated in _chacha20poly1305_init never zeroized before function returns. ChaCha context ctx (whose chacha.input[4..11] holds full 256-bit master/session key schedule) never zeroized on error paths of chacha20poly1305_encrypt_mbuf/_decrypt_mbuf. _chacha20poly1305_mbuf returns EINVAL at lines 317 and 338 without touching ctx so caller returns with full key schedule and poly state still on stack frame. XChaCha wrappers DO zero derived_key but same hygiene not applied to poly_key. Requires separate stack-info-leak primitive. For WireGuard caller exposes session key decrypting/injecting all traffic for that keypair.