nfs_mountdiskless() double-frees the dup_sockaddr() on mountnfs() failure (mountnfs's bad: path frees nm_nam via nfs_free_mount, then haderror kfrees it again)

Summary

nfs_mountdiskless() dup_sockaddr()'s nam (:745) and passes ownership to mountnfs(), which stores it as nmp->nm_nam (:1077). On failure mountnfs()'s bad: label runs nfs_free_mount(nmp) (:1167-1171), which kfrees nmp->nm_nam (:1255-1257). Control returns to nfs_mountdiskless(), whose haderror path kfrees the same nam again (:775). Source-certain double free; reachability diskless-boot only (nfs_mountroot -> nfs_mountdiskless for root or swap, e.g. NFS server unreachable or nfs_nget ENOMEM) - attacker must control the PXE/BOOTP/NFS boot environment. LAN attacker controlling the boot environment (or a merely dead NFS server) during diskless boot gets a slab double-free during an already-failing boot; realistic impact crash-of-a-crashing-boot, heap-corruption potential only in a PXE-groomed scenario. Not verified (boot-time; Low per contract). Fix: drop the kfree(nam) in the haderror path (ownership transferred).