[MrIron-no]

Summary

Four small memory-safety fixes, one per commit. Two are stale reads of a
freed structure, one is a use-after-free of a connection buffer that is
also a logic bug, and one is undefined behaviour in address encoding.

sline.c — stale read after the timeout callback releases an entry

sline_hold_timeout_callback() calls sline_release_hold(entry->token),
which unlinks and frees the entry, then reads entry->token again for
the two Debug() lines that follow. Copy the token before the call.
Debug builds only; reads only.

numnicks.c — signed shift overflow in iptobase64()

ntohs() yields a 16-bit value that is promoted to int, so
(ntohs(x) << 16) overflows for any IPv4 address whose first two octets
are 192.0 or higher. Every compiler in use produces the intended bit
pattern, but it is undefined behaviour. Shift as unsigned. Present since
the 2004 IPv6 work.

parse.c / packet.c — message tags outlive the line they came from

msg_tag_parse() does not copy: each tag's key and value point into the
sending client's con_buffer. parse.c keeps the list in a static that
is only reset when the next line is parsed, and send_buffer() falls
back to that list whenever it is called without an explicit tag context.

So any send made outside a command handler picked up the previous line's
tags: exit_client() from a socket EOF/error callback, anything driven
by a timer. That is wrong even when nothing has been freed (an unrelated
client's ERROR :Closing Link carries someone else's label/msgid),
and once the client that sent that line is gone it is a read from a
freed connection.

Clear the list in packet.c right after each dispatch, so the fallback
is only live while the handler that owns the line runs. Every send made
from a handler is unaffected.

s_bsd.c — process timer touches a client read_packet() freed

client_timer_callback() drains pending input with read_packet(),
which can exit the client (a QUIT in the buffer, a registration failure)
and free its struct Client. The trailing consistency assert then read
cli_connect() from the freed structure. Return when read_packet()
reports CPTR_KILLED.

Testing

Builds warning-free (--enable-warnings); ircd/test unit suite passes;
the docker integration suite passes with the ircds built with
-fsanitize=address,undefined.