vke_stop() teardown can hang the vkernel forever: the tx cothread's done-fifo full-wait never checks the exit flag, and once the exit flag is set vke_tx_intr() refuses to drain the done fifo, so cothread_delete()'s pthread_join blocks while holding if_serializer

Summary

The done-fifo full-wait never rechecks cotd_tx_exit; once teardown sets the exit flag, tx_intr returns BEFORE its drain loop, so nothing ever drains again - cothread_delete's pthread_join blocks while ifconfig's ioctl holds if_serializer, wedging the whole vkernel. Trigger: guest-unpriv packet flood + guest-root ifconfig down. Host-facing surface verified size-exact (no host-kernel impact). Exit-aware wait + drain-before-free fix.