dm-thin: fix metadata refcount underflow (CVE-2026-46107) | HOL Guard CVE