CVE-2026-89498: orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix double-free of trailerbuf on readdir copy failure

On a readdir downcall, orangefsdevreqwriteiter() frees op->downcall.trailerbuf with vfree() when copyfromiterfull() fails, but does not clear the pointer before goto Efault. The waiter in doreaddir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailersize exceeds the bytes it supplies.

Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.