Kernel memory corruption via shifted BPF stack slot

Memory corruption in the Linux 7.0 LoongArch BPF JIT allows attackers to crash the kernel through an arena BPF program. In build_prologue() and __build_epilogue(), the optional arena-register slot shifts the hardcoded tail-call-counter pointer offset, so the JIT loads the counter value and dereferences it as a pointer. The path requires a LoongArch kernel to JIT-compile an arena BPF program that performs a tail call or BPF-to-BPF call; the invalid dereference corrupts kernel memory or panics the system.