DF-0619: rip6_send heap OOB read via short sockaddr
sizeof(struct sockaddr_in6) = 28
short sockaddr sa_len       = 2
over-read                   = 26 bytes

opened AF_INET6/SOCK_RAW fd=3

--- control case (these MUST return EINVAL on both buggy & fixed) ---
  bind(2-byte sa)        rc=-1 errno=22 (Invalid argument)
  connect(2-byte sa)     rc=-1 errno=22 (Invalid argument)

--- BUGGY behavior: sendto() reaches rip6_send w/o sa_len check ---
--- on buggy kernel: NOT EINVAL (typically EADDRNOTAVAIL/etc)   ---
--- on fixed kernel: EAFNOSUPPORT / EINVAL immediately         ---
  sendto(2-byte sa)      rc=-1 errno=65 (No route to host)

--- 5x sendto(2-byte sa) for stability ---
  iter 0: sendto rc=-1 errno=65 (No route to host)
  iter 1: sendto rc=-1 errno=65 (No route to host)
  iter 2: sendto rc=-1 errno=65 (No route to host)
  iter 3: sendto rc=-1 errno=65 (No route to host)
  iter 4: sendto rc=-1 errno=65 (No route to host)
RUN_EXIT=0