File refcount / unp_rights leak when ssb_appendcontrol fails on SOCK_STREAM SCM_RIGHTS

Summary

In uipc_send SOCK_STREAM/SEQPACKET control path when ssb_appendcontrol returns 0 (peer so_rcv no space) code silently leaves control and m non-NULL but never sets error. Post-switch cleanup if(control&&error!=0) unp_dispose(control) skips unp_dispose and m_freem(control) only frees mbuf releasing none of file references that unp_internalize acquired via fhold()+unp_add_right(). Leaked refs keep files and unp_rights inflated permanently enabling slow kernel-memory exhaustion. Any local user.