hammer2_xop_start_except NULL deref under unpriv nlookup storm mode 0xd - candidate new finding

Summary

Unpriv nlookup storm mode 0xf minus strategy-reader (0xd) trips a NULL+0x81554 read at hammer2_xop_start_except+0x25 on the stock kernel - proven pre-existing on pristine stock and independent of the DF-5846 5847 5848 fixes; attribution transcripts preserved in findings/poc/DF-5846; needs dedicated root-cause pass to identify the NULL xop field and reachability chain