possible bug in in_l2tp_match

[Maxime Villard <max%m00nbsd.net@localhost>]

I don't think in_l2tp_match() is really correct [1]. Here the mbuf given
as argument is pulled up, but the new pointer is not passed back (detected
as memory leak by Mootja). And it doesn't look like this kind of functions
is supposed to free the mbuf on error either. Same in in6_l2tp_match().

Please enlighten the code with a comment or two if I'm mistaken.

Maxime

[1] https://nxr.netbsd.org/xref/src/sys/netinet/in_l2tp.c?r=1.4#363