Memory leak of struct ngd_connection in ng_device_disconnect (unbounded kernel heap exhaustion)

Summary

ng_device_disconnect frees readq and destroys ngddev removes connection from list but never kfrees connection struct itself. Each hook teardown leaks sizeof(struct ngd_connection). SLIST_REMOVE recycles unit number attacker can repeat connect/disconnect indefinitely growing kernel heap without bound. ~48 bytes per cycle slow kmem exhaustion.