avoid leaking memory when mbuf chain allocations fail in tun_dev_write()

the mbufs built by tun_dev_write used to be limited to a single
mbuf and cluster, but has grown in complexity now that it supports
tun_hdr and tso, which required building mbuf chains. some of the
error handling when allocating mbuf bits wasnt adapted to free the
preceding chain when later allocaitons failed, resulting in a memory
leak.

reported by frank denis

sys/net/if_tun.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_tun.c,v 1.256 2025/12/14 01:51:26 dlg Exp $	*/
+/*	$OpenBSD: if_tun.c,v 1.257 2026/05/09 01:47:12 dlg Exp $	*/
 /*	$NetBSD: if_tun.c,v 1.24 1996/05/07 02:40:48 thorpej Exp $	*/
 
 /*
@@ -1009,7 +1009,7 @@ tun_dev_write(dev_t dev, struct uio *uio, int ioflag, int align)
 			m_clget(m, M_DONTWAIT, alen);
 			if (!ISSET(m->m_flags, M_EXT)) {
 				error = ENOMEM;
-				goto put;
+				goto drop;
 			}
 		}
 
@@ -1031,7 +1031,7 @@ tun_dev_write(dev_t dev, struct uio *uio, int ioflag, int align)
 		n = m_get(M_DONTWAIT, MT_DATA);
 		if (n == NULL) {
 			error = ENOMEM;
-			goto put;
+			goto drop;
 		}
 
 		align = 0;