Local memory corruption via freed DMA buffer

Use-after-free in the Linux Kernel ENETC driver allows local users to corrupt kernel memory through a timed-out NTMP command. The timeout path returns without aborting the pending hardware command, while ntmp_free_data_mem() frees its DMA response buffer; the device later writes to that freed physical address. Reaching the flaw requires local low-privileged access, an affected ENETC device, and an NTMP command that times out; consequences include data exposure or alteration and a system crash.