AZL-96366

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix user refcount underflow in event delivery

ipmiallocrecvmsg(user) takes the temporary user reference owned by the receive message, and ipmifreerecvmsg() drops it again. If event delivery fails after allocating receive messages for earlier users, handlereadeventrsp() rolls those messages back with ipmifreerecvmsg().

That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcountt's addition-on-zero warning when ipmiallocrecvmsg() tries to acquire another reference.

Remove the stale explicit put and the now-dead user assignment. Keep the listdel() and ipmifreerecvmsg() calls; they are the required rollback operations.