CVE-2026-98449: smb: client: delete compound mids on send failure before unlock

In the Linux kernel, the following vulnerability has been resolved:

smb: client: delete compound mids on send failure before unlock

When sending a compound request fails, smbsendrqst() kicks off a reconnect. compoundsendrecv() still has those mids on pendingmidq, but it unlocks the server without removing them first.

During reconnect, cifsabortconnection() walks pendingmidq and runs each mid callback. With no response yet, those callbacks return credits and drop inflight. Then compoundsendrecv()'s send-error path returns the same credits again. inflight ends up decremented twice and smb2addcredits() WARNs.

syzbot hits this during SMB2negotiate when the socket send fails.

cifscallasync() already calls deletemid() before unlock on send failure. Do the same for compound chains and set cancelledmid[] so the out: path does not delete them again.