Fix logic error in TFTP caching.

The TFTP subsystem prefetches data from disk. If a TFTP transfer
is freed, and a new one allocated the same memory, then previously
prefetched data could be wrongly supplied.

Thanks to Lucas Celant <lcelant@redhat.com> for spotting this.

CVE-2026-93006 may apply.

src/tftp.c

@@ -836,6 +836,12 @@ static void free_transfer(struct tftp_transfer *transfer)
       close(transfer->file->fd);
       free(transfer->file);
     }
+
+  /* freeing this transfer and then allocating a new one
+     may result in the same memory, but the contents of
+     the transfer is no longer valid to cache. */
+  if (daemon->srv_save == transfer)
+    daemon->srv_save = NULL;
   
   free(transfer);
 }