carp: Fix pullup checks

[markj]

Summary

The conditions used to test whether a pullup is needed were inverted.

While here:

• Fix a bogus assignment to "iplen": it's already initialized to *offp.
• Use in_cksum_skip() instead of manually adjusting the data pointer. Otherwise the mbuf is temporarily in an invalid state, since m_len isn't updated to match.

Reported by: KMSAN
Sponsored by: Klara, Inc.
Fixes: 37115154672f ("carp: support VRRPv3")

[markj]

Use in_cksum_skip() in carp6_input() as well.

[markj]

sys/netinet/ip_carp.c

597

This and the other in_cksum_skip() call is wrong. in_cksum_skip() has a weird interface: the offset should be included in the length, so we always have len >= off, and the function checksums len - off bytes.

Currently waiting for a test run to finish with this call changed to in_cksum_skip(m, totlen, iplen) and the one below changed to in_cksum_skip(m, sizeof(struct carp_header) + *offp, *offp).