Use-after-free read of rqp->sr_flags in smb_t2_request_int error path

Summary

On every error path of smb_t2_request_int smb_rq_done(rqp) frees rqp then rqp->sr_flags read on next line to test SMBR_RESTART. Freed slab slot read before any other allocation can reuse in this thread but under concurrent M_SMBRQ pressure another object can land in slot its bytes interpreted as sr_flags. smb_rq_done calls kfree(rqp M_SMBRQ) whenever SMBR_ALLOCED set (always by smb_rq_alloc). Every error path reaches this epilogue. Attacker malicious/MitM SMB server causing TRANS2 error (malformed response). Worst case spurious SMBT2_RESTART retry loop or prevent legitimate retry.