etcp: etcp_inflight_nullify_link читал entry->data вместо entry — last_link не обнулялся (UAF в bbr/retrans)

src/transport_layer/etcp_connections.c

@@ -951,7 +951,7 @@ static void etcp_inflight_nullify_link(struct ll_queue* q, struct ETCP_LINK* dea
     if (!q) return;
     struct ll_entry* entry = q->head;
     while (entry) {
-        struct INFLIGHT_PACKET* inf = (struct INFLIGHT_PACKET*)entry->data;
+        struct INFLIGHT_PACKET* inf = (struct INFLIGHT_PACKET*)entry;
         if (inf->last_link == dead_link) inf->last_link = NULL;
         entry = entry->next;
     }