Process-memory disclosure via missing warning argument

Format string misuse in Tcpreplay 4.4.1 allows attackers to disclose process memory when an IPv6 checksum warning is generated. The fix_ipv6_checksums function passes a format string containing three conversion fields to tcpedit_setwarn but supplies only two values, so the variadic formatter reads an unrelated stack value for the missing capture-length argument. The warning path is reached while checksum correction handles an IPv6 packet whose declared length is shorter than its computed header length; the upstream report states that attacker-controlled input requirements remain unknown.