Failed MNT_UPDATE remount leaves mp->mnt_data dangling: use-after-free of struct udf_mnt on the live mount (double free at unmount)

Summary

udf_mount (:153-157) falls through to udf_mountfs() on MNT_UPDATE whenever args.fspec != NULL; udf_mountfs then unconditionally overwrites mp->mnt_data with a freshly allocated udf_mnt (:263-272) and, on ANY later failure (bad anchor :283, missing descriptors :329, fsd_part mismatch :334, bad FSD/root FE), bail (:393-403) kfrees that structure WITHOUT restoring the previous pointer. sys_mount's MNT_UPDATE failure path only restores mnt_flag/mnt_kern_flag - the UDF mount stays alive with mnt_data pointing at freed heap. Every subsequent VFS op deriving udfmp from the mount is a UAF: lookup -> udf_vget -> udf_hashlookup derefs the freed chunk's hash_token/hashtbl/hashsz; umount does a second VOP_CLOSE through freed im_devvp, a second vrele, and kfree(udfmp) again (double free), plus a NULL write through im_devvp->v_rdev->si_mountpoint (groomable pointer). A successful remount instead silently leaks the previous udf_mnt + hashtbl + old device vnode forever. Any principal holding the mount privilege (root; delegated cap / vfs.usermount=1) can, by attempting to remount a live UDF filesystem onto a blank/garbage device - a FAILED operation - permanently convert every later access to that filesystem into kernel UAF. VERIFIED stock INVARIANTS: trigger (MNT_UPDATE+fspec=/dev/vn1 zeros) returns EINVAL with mnt_data dangling; `ls /mnt/T25` (never-cached) -> 'panic: assertion count & TOK_COUNTMASK failed in _lwkt_reltokref', stack lwkt_gettoken<-udf_hashlookup<-udf_vget - the freed chunk already reused. Fix validated (reject MNT_UPDATE+fspec EOPNOTSUPP + save/restore mnt_data on bail, kernel #1): trigger gets errno 45, mount stays healthy, lookup succeeds. Escalation beyond panic gated behind mount privilege (uid0 adds nothing).