Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade

- **Component:** libcurl — `lib/setopt.c`, `CURLOPT_REFERER` handler (`curl_easy_setopt` API) - **Related code paths:** `lib/bufref.c` (`Curl_bufref_free`), `CURLINFO_REFERER` getter (`lib/getinfo.c:145`), referer emission (`lib/http.c:2941-2945`), pretransfer sync (`lib/transfer.c:511-512`) - …

/* ff300ac4aa (vulnerable): free BEFORE read */
case CURLOPT_REFERER:
    Curl_bufref_free(&data->state.referer);              /* frees */
    result = Curl_setstropt(&s->str[STRING_SET_REFERER], ptr);  /* strlen(ptr) → UAF */
    break;