dc_setfilt_21143/dc_setfilt_xircom enqueue the setup frame with no TX-ring-space check: descriptor clobber of an in-flight frame, leaked mbuf, and tx_cnt overrun when invoked on a saturated ring

Summary

Both setup-frame builders blindly take the next TX slot with no check that the chain slot is free or that tx_cnt < ring size - unlike dc_encap, which refuses to pack when the 5-slot reserve is insufficient, and dc_start, which stops at a non-NULL chain slot. dc_setfilt runs on live interfaces from unprivileged-triggerable ioctls (SIOCADDMULTI/SIOCDELMULTI via multicast socket options, SIOCSIFFLAGS promisc toggles) and from dc_txeof's PNIC retry. Repeated setfilt calls on a ring kept full by concurrent TX saturate the reserve: once tx_cnt reaches the ring size, tx_prod wraps onto a still-pending (OWN) descriptor, the setup frame overwrites it, and the chain-store drops the pending frame's mbuf pointer (leak), while tx_cnt exceeds the ring size. Mbuf leak per event (repeatable exhaustion), corrupted in-flight descriptor (transmit wedge), broken ring accounting. No demonstrated write outside fixed structures. Guard fix.