mbuf: ensure next pointer is set to null on free