freerd_state allocation prologue runs unlocked and is reachable from two threads concurrently — orphaned kdmsg_state leak

Summary

The freerd_state prologue reads/kmallocs/assigns iocom->freerd_state BEFORE acquiring msglk, justified by a comment claiming no races — false: kdmsg_state_abort releases msglk and calls kdmsg_state_msgrx from the WRITER thread (deferred aborts in cleanuptx and drain paths), so both threads can execute the unlocked prologue simultaneously. Interleaving read-NULL/alloc/write loses one update and permanently orphans a fully-initialized state (refs=1, no pointer) — a 160-byte leak the peer can provoke by racing teardown traffic against new commands. No corruption possible (the under-lock handoff is serialized — a state can only be leaked, never double-used). Move-population-under-msglk fix proposed. Code-path proof only (Low).