using memory after freed in tcp_syncache (syncache_timer())

[Don Bowman]

From: Don Bowman
 ...
It appears this may also occur in syncache_add():
in this case, syncache_respond() alters the list.

                sc->sc_tp = tp;
                sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
                if (syncache_respond(sc, m) == 0) {
                        s = splnet();
                        TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
                            sc, sc_timerq);
                        SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
                        splx(s);
                        tcpstat.tcps_sndacks++;
                        tcpstat.tcps_sndtotal++;
                }
                *sop = NULL;