Fix KSChan point-process OOB write of dparam[2] (#3843) (#3844)

KSChan::alloc always nulled prop->dparam[2] for point processes, but
that slot exists only when single-channel mode (or later fields) makes
ppsize > 2. Plain point KSChan instances allocate only area and pnt, so
the write was past the allocated Datum vector. The default ArrayPool
freelist order hid the overflow inside the next free slab row; a
reversed freelist exposes it under ASAN.

nrn_prop_datum_alloc already default-constructs every Datum to null, and
dparam[0]/[1] are filled by point.cpp after nrn_alloc. The redundant
nulling is removed; single_->alloc still runs when single_ is set and
the singleptr slot is null.

Author: nrnhines

src/nrniv/kschan.cpp

@@ -2328,9 +2328,6 @@ void KSChan::alloc(Prop* prop) {
     if (!is_point() || nrn_point_prop_ == 0) {
         if (ppsize > 0) {
             prop->dparam = nrn_prop_datum_alloc(prop->_type, ppsize, prop);
-            if (is_point()) {
-                prop->dparam[2] = nullptr;
-            }
         } else {
             prop->dparam = 0;
         }