Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`) (CVE-2026-10640) | HOL Guard CVE