in_delayed_cksum writes through unchecked m_pullup return and silently drops the (possibly reallocated) mbuf pointer

Summary

in_delayed_cksum calls m_pullup to coalesce transport checksum field into first mbuf but (a) never checks return for NULL before dereferencing at :951 and (b) takes mbuf by value so callers (ip_output:641 ip_fragment:802 ip_mloopback:1881) never see new pointer m_pullup may return. Under rare condition where m_pullup takes allocate-new-head branch allocation failure panics kernel via NULL->m_data deref. Successful reallocation leaves every caller holding freed pointer UAF on subsequent m->m_pkthdr.csum_flags write and ifp->if_output handoff. Other two m_pullup callers in this file both NULL-check return this one is outlier. XXX comment at :944-947 shows authors knew layout assumption fragile. Trigger requires non-standard mbuf layout M_EXT/headroom-short/m_next==NULL not reachable from standard UDP/TCP/RAWOUTPUT paths. [VERIFIED pass2: reproduced mechanism - cluster-head split forces m_pullup allocate-new-head branch leaving caller-held pointer on freed mbuf; no standard-path trigger demonstrated; NULL-check fix in combined kernel]