===== DF-0677 FIXED (slcompress.c with clamp): kldload ./slc_oob.ko =====
KLDLOAD_EXIT=0
DF0677: sizeof(struct slcompress)=4656  sizeof(struct cstate)=144  MAX_STATES=16
DF0677: comp=0xfffff80118888000 max_state=255  guard=[0xfffff80118889230..0xfffff80118899230) sentinel=0xaa
DF0677: RESULT=NO_OVERFLOW  guard region untouched (clamp held, max_state=255)

Interpretation:
- With the clamp `if (max_state < 0 || max_state > MAX_STATES - 1) max_state = MAX_STATES - 1;`
  added to sl_compress_init(), max_state=255 is clamped to 15 BEFORE the loop.
- The loop now only writes tstate[1..15] (all in-bounds). guard[0..15] stays all 0xAA.
- 0 bytes clobbered => the OOB is closed.

Fix validated against the same harness that demonstrated the overflow on the unpatched
baseline (see run.log). This is the sppp/sl/netgraph7_vjc module source
(net/ppp_layer/slcompress.c); the fix ships in whichever of those modules is loaded.