Use-after-return in Zephyr getaddrinfo() asynchronous DNS retry handling

CVE-2026-10646 is a use-after-return flaw in Zephyr's BSD-sockets getaddrinfo() implementation in subsys/net/lib/sockets/getaddrinfo.c affecting Zephyr v4.0.0 through v4.4.0. The vulnerable code stores a pointer to a stack-allocated struct getaddrinfo_state object (ai_state) in the user_data field of an asynchronous DNS resolver query. If the socket layer's semaphore wait times out with -EAGAIN, the pre-fix logic retries the DNS query via goto again without cancelling the prior outstanding resolver query and without resetting the semaphore. As a result, the earlier resolver slot remains active and still references the stale stack pointer in its callback context, while ai_state.dns_id is overwritten, preventing later cancellation of the stale query. When a delayed DNS response is later processed, or when the resolver's delayed timeout work fires, dns_resolve_cb() is invoked with the stale user_data pointer and writes into memory belonging to an out-of-scope stack frame, including state fields such as status, idx, ai_arr[] and signaling the semaphore via k_sem_give(). This creates a network-influenceable use-after-return condition that can corrupt reused stack memory.