[AFTER] m_getjcl(MJUMPAGESIZE) (cluster=4096):
  OK: copy of 3004 bytes fits in 4096-byte cluster — no overflow

[AFTER2] defense-in-depth bound (reject dmalen+rxd > cluster):
  OK: oversize frame REJECTED before the copy — no overflow

verdict: the vulnerable m_getcl() path overflows; the patched m_getjcl()+bound path does not.