Kernel panic via freplace tail-call counter reset

Infinite-loop denial of service in Linux kernel 5.6 through 6.12.4 allows local users to trigger a kernel panic. The BPF tail-call counter resets to zero each time an freplace extension reenters the target, so the entry_tc-to-subprog_tc-to-entry_freplace chain never reaches the tail-call limit. A local user able to load, attach, and test BPF extension programs can crash the host without interaction from another user.