# DF-0634 — Heap OOB read in `ng_tag_rcvdata` mbuf-tag matching

## Bug
`sys/netgraph7/ng_tag.c:525,534-544` — `ng_tag_rcvdata()` calls
`memcmp((void*)(tag+1), hip->in_tag_data, tag_len)` with the
**user-configured** `tag_len` (up to 65535) instead of the located
tag's own `m_tag_len`. `m_tag_locate` matches on `(cookie, type)` only,
so a tag of any data length can be returned; if `tag_len > m_tag_len`
the `memcmp` reads `tag_len - m_tag_len` bytes past the allocation.

## Live trigger not on default guest
`ng_tag.c` is `optional netgraph7_tag` and is **not built** as a module
or in the default kernel (verified: `ls /boot/kernel/ng_tag.ko` =
nothing). To trigger, build a kernel or module with the option and load
it. Verification is by source trace + userspace OOB-pattern harness
(see VERDICT.md).

## Reproduce (harness)
```sh
./build.sh
./run.sh
# Expected output: "kernel memcmp would PAGE FAULT here (panic)" -
# proves the OOB read pattern when tag_len > m_tag_len.
```

## Expected impact
- DoS (panic) with large overshoot, or
- Slow heap info-leak (≤256 probes per byte) via ifMatch/ifNotMatch
  routing side channel with small overshoot.
- Root-only (SYSCAP_RESTRICTEDROOT for AF_NETGRAPH socket).