CVE-2025-40285 smb/server: fix possible refcount leak in smb2_sess_setup()