Unchecked copyin() return in sys_vquotactl feeds an uninitialized stack plistref to _prop_object_copyin

Summary

error = copyin(...) is immediately overwritten by prop_dictionary_copyin's return: on copyin failure the 16-byte stack plistref holds prior stack residue whose garbage pref_len/pref_plist reach the kmalloc/copyin sinks (DF-2231 class via an uninitialized variable). Needs deterministic stack-grooming to trigger - provable by inspection; the if(error) return guard is included in the combined validated fix.