output_ifp stored without ifnet lifetime protection UAF on interface detach

Summary

ng_source_store_output_ifp does sc->output_ifp=ifp(:623) with only ifnet_lock held transiently for ifunit lookup NO reference on struct ifnet DragonFly has no if_ref() API. Pointer dereferenced locklessly by periodic callout ng_source_intr ifq_get_subq_default(&sc->output_ifp->if_snd)(:740-743). If interface detached(USB unplug vlan/bridge destroy) struct ifnet freed while sc->output_ifp still points next START->callout->ng_source_intr touches freed memory softirq context. Latent file not built by default.