nfssvc_nfsd() socket-zap race after the pipelined dorec leaks the request's mbuf chain and client address (:576-579 frees only the descriptor)

Summary

After processing a request, the loop re-arms via nfsrv_dorec() at :781 and - on success - releases slp->ns_token at :793 before re-acquiring at :554. In that window another nfsd on the same socket can nfsrv_zapsock() it (EPIPE on its own reply), clearing SLP_VALID. The re-acquiring nfsd then hits the ':575 guard' with a live nd and frees only the descriptor (kfree(nd) at :577) - nd->nd_mrep (up to NFS_MAXPACKET of mbufs) and nd->nd_nam2 (M_SONAME) never released, unlike RC_DROPIT/RC_REPLY paths. A remote unauthenticated NFS/TCP client that pipelines requests and resets the connection (driving concurrent EPIPE teardown on a sibling nfsd) can leak one mbuf chain + sockaddr per won race - slow kernel-memory exhaustion / DoS against a running NFS server. Narrow window; requires multiple nfsds. Not guest-verified (race; Low). Fix: free the full request in the :575 path matching RC_DROPIT.