Decrypted but unauthenticated plaintext written back to mbuf before tag check

Summary

In _chacha20poly1305_mbuf decryption path decrypts final block into local buffer then unconditionally writes decrypted block back into mbuf with m_copyback before and regardless of whether _final returned false (tag mismatch EBADMSG). Same applies to every block earlier in loop. On auth failure mbuf left containing attacker-influenced decrypted data. WireGuard caller drops on EBADMSG so no current leak but AEAD contract plaintext never released on MAC failure violated at library layer.