Service crash via dangling tap listener

Expired pointer dereference in sharkd in Wireshark before 4.6.8 and 4.4.18 allows attackers to crash the service via crafted input. In sharkd_session_process_tap(), sharkd registers a stack-local rtpstream_tapinfo_t as a global tap listener and several error returns exit before unregistering it, leaving a dangling pointer that later dereferences freed stack memory during tap reset. Reachability depends on how sharkd is exposed: the vendor describes malformed packets on the wire or crafted capture files, while the issue report demonstrates a crash through a sequence of crafted tap requests against sharkd.