CVE-2026-23286 atm: lec: fix null-ptr-deref in lec_arp_clear_vccs