fix(mdns): Don't free a browse result already freed by an earlier sync batch

browse_sync() frees sync_result->result whenever result->ttl is 0 at
processing time, but sync entries only borrow the node: one packet
produces one mdns_browse_sync_t, each queued as its own
ACTION_BROWSE_SYNC, and add_browse_result() dedupes within a single
batch only. mdns_priv_query_update_result_ttl() takes the minimum, so a
goodbye lowers a cached node's TTL to 0 and re-adds it to a fresh batch
while an older batch still references it. Processing the older batch
frees the node; processing the newer one reads result->ttl from freed
memory and frees it again:

  assert failed: tlsf_free ... block already marked as free
    mdns_mem_free                 mdns_mem_caps.c
    mdns_priv_query_results_free  mdns_querier.c
    browse_sync                   mdns_browser.c
    mdns_priv_browse_action       mdns_browser.c
    execute_action                mdns_service.c

Skip sync entries whose node is no longer linked in browse->result. That
covers both the use-after-free read and the second free, and needs no
change to the result lifetime or to the sync batch layout.

Author: eriknorth

components/mdns/mdns_browser.c

@@ -56,6 +56,24 @@ static void browse_item_free(mdns_browse_t *browse)
     mdns_mem_free(browse);
 }
 
+/**
+ * @brief Check that a result node is still linked in the browse cache
+ *
+ * Sync entries hold a borrowed pointer to a node in @c browse->result. One node
+ * can be referenced by several queued sync batches, and the first batch to see
+ * it with @c ttl==0 detaches and frees it, so a later batch must not use its
+ * pointer without checking.
+ */
+static bool result_is_cached(const mdns_browse_t *browse, const mdns_result_t *result)
+{
+    for (const mdns_result_t *r = browse->result; r != NULL; r = r->next) {
+        if (r == result) {
+            return true;
+        }
+    }
+    return false;
+}
+
 /**
  * @brief Deliver browse updates to the user notifier
  *
@@ -70,6 +88,11 @@ static void browse_sync(mdns_browse_sync_t *browse_sync)
     mdns_browse_result_sync_t *sync_result = browse_sync->sync_result;
     while (sync_result) {
         mdns_result_t *result = sync_result->result;
+        if (!result_is_cached(browse, result)) {
+            // Already removed and freed by an earlier sync batch
+            sync_result = sync_result->next;
+            continue;
+        }
         DBG_BROWSE_RESULTS(result, browse_sync->browse);
         browse->notifier(result);
         if (result->ttl == 0) {