eqn(7) .EQ has to break man(7) next-line scope, or tree corruption

and use after free many ensue; again found by jsg@ with afl(1)

1 files changed, 2 insertions, 0 deletions

diff --git a/roff.c b/roff.c
index 1d181d32..b3f80352 100644
--- a/roff.c
+++ b/roff.c
@@ -2879,6 +2879,8 @@ roff_EQ(ROFF_ARGS)
 {
 	struct roff_node	*n;
 
+	if (r->man->macroset == MACROSET_MAN)
+		man_breakscope(r->man, ROFF_EQ);
 	n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE);
 	if (ln > r->man->last->line)
 		n->flags |= NODE_LINE;