CVE-2025-40027 net/9p: fix double req put in p9_fd_cancelled