enic TxHangReset UAF

Vulnerability analysis

During device removal, the enic driver cancels some deferred work items but omits the TX hang reset work, and the cancellation method it uses does not prevent the still-live network watchdog from re-scheduling work in the window before the device is unregistered. If a TX timeout fires during that window, the reset work runs after the network device structure has already been freed, resulting in a use-after-free. The fix replaces the cancellation calls with a mechanism that both cancels pending work and permanently blocks future scheduling, applied to all teardown work items so the requeue race is closed uniformly. The vulnerable path is reachable only on systems with the Cisco enic PCI NIC driver loaded, requires privileged device removal (PCI hot-unplug), and depends on a TX timeout firing during the narrow removal window.