CVE-2026-74623: net: atlantic: free stranded TX buffers on ring deinit

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: free stranded TX buffers on ring deinit

aqvecdeinit() drains the TX rings with a single aqringtxclean() call, which frees at most AQCFGTXCLEANBUDGET (256) descriptors and stops at hwhead, which no longer moves once aqvecstop() has stopped the hardware and NAPI. Completed descriptors beyond the budget and everything still posted in [hwhead, swtail) keep their skb or xdpframe when the interface goes down: aqvecringfree() then frees the buffer ring and the references are lost for good.

Today this is a silent memory leak on every interface down under TX/XDPTX load. With the conversion of the RX path to pagepool posted for net-next it becomes much more visible: XDPTX frames carry fragment references on the RX ring's pagepool, so a single stranded frame keeps the pool's inflight count above zero forever. pagepooldestroy() then never completes, the pool is leaked together with its pages, and "pagepoolreleaseretry() stalled pool shutdown" is warned every 60 seconds from that point on, on every ifdown, XDP detach or ring resize under XDPTX load.

Bring back aqringtxdeinit() as it was before the removal and use it for teardown again, with one extension: TX rings can hold xdpframes nowadays, so release those too. They are returned with xdpreturnframe() since this runs in process context.