if_stf teardown races its in-flight decap consumers: unguarded MOD_UNLOAD frees the softc under the lock-free encaptab walk and past the async NETISR_IPV6 queue carrying rcvif=&sc->sc_if - use-after-free (DF-3425 gif twin, wider async vector)

Summary

stfmodevent(MOD_UNLOAD) has no in-use guard and no serialization against (a) encap4_input's lock-free encaptab walk calling stf_encapcheck (mutators under crit only - the DF-3425 defect, stf instance), and (b) mbufs already decapsulated by in_stf_input carrying rcvif=&sc->sc_if into netisr_queue(NETISR_IPV6) which ip6_input touches after if_detach freed it. REPRODUCED: Fatal trap 9 (GP on 0xdeadc0de-poisoned freed pointer) at nd6_purge+0xc9 in the if_detach/in6_ifdetach teardown on netisr0, ~80s/~4000 unload cycles/~24M injected 6to4 frames with debug.use_weird_array=1 proving post-free access; the bare walk-instant variant (79.1M floods/1969 cycles) did NOT panic - honest negative on that half, the stf mutator is only kldunload-speed. Root-gated kldunload under peer traffic (same trust boundary as the reproduced DF-3425 twin): freed-memory reads AND writes (IFNET_STAT_INC/in6_ifstat_inc through freed sc/if_afdata) - panic demonstrated; constrained write-after-free primitive (slab-groomable 2-4KB softc chunk) not escalated. Fix validated (EBUSY-while-UP + ip_encap mp_token, two patched kernels): 48M+19M frames, all unloads refused, no panic. M_LENCHECKED hunt for stf was negative (v6 path re-validates plen - not a missed DF-3321 family member).