=== DF-0508: ng_l2cap ConfigReq unknown-option pkthdr.len inflation ===

NOTE: netgraph7 is NOT compiled on DragonFlyBSD master.
      Bug confirmed by source trace; harness demonstrates the logic.

Crafted ConfigReq: actual data = 7 bytes
Unknown option claims length=255 but only 1 byte present

  Initial pkthdr.len = 7 (matches actual data)
  Option at off=4: type=0x06 length=255 hint=0
    -> unknown non-hint option, return -3

  [BUG] m_adj(m, off - sizeof(hdr))
  [BUG] m->m_pkthdr.len = sizeof(hdr) + hdr->length
  -> pkthdr.len set to 259, but actual data is only 7 bytes!
  -> INFLATED by 252 bytes

  BUG CONFIRMED: pkthdr.len (259) > actual data (7)
  When this mbuf is echoed in ConfigRsp:
    -> ng_l2cap_lp_send sets on-air length from pkthdr.len
    -> usbd_m_copy_in reads 252 bytes past mbuf chain end
    -> kernel heap leaked to attacker via Bluetooth
RUN_EXIT=0