mfc entries kmalloc without M_ZERO only [0 numvifs) of mfc_ttls/mfc_flags initialized later add_vif exposes uninitialized heap bytes via forwarding decisions

Summary

Both mfc allocation sites use kmalloc no M_ZERO then init_mfc_params/update_mfc_params only initialize mfc_ttls[i]/mfc_flags[i] for i in [0 numvifs). If numvifs later grows (add_vif :853) new vif slots in every existing mfc remain uninitialized heap data. ip_mdq reads them (:1569) to decide whether to forward. Non-zero garbage with ip_ttl>garbage causes multicast replicated onto unauthorized vif. Weak byte-is-nonzero oracle into prior kernel heap. Root-only multicast routing daemon.