BUILD_EXIT=0
=== RUN ===
DF-0981 run_bulk_rx_callback aggregated-frame OOB harness
xferlen        = 4096 (RUN_MAX_RXSZ)
dmalen         = 3000 (device-controlled, > MCLBYTES)
copy length    = 3004 (dmalen + sizeof(rt2870_rxd)=4)
MCLBYTES       = 2048   (m_getcl cluster — VULNERABLE alloc)
MJUMPAGESIZE   = 4096   (m_getjcl cluster — FIXED alloc)

[BEFORE] m_getcl() (cluster=2048), no extra bound:
  *** HEAP OOB WRITE CONFIRMED: 956 bytes past the 2048-byte cluster ***
  -> matches if_run.c:3023-3024 m_copydata() overflow

[AFTER] m_getjcl(MJUMPAGESIZE) (cluster=4096):
  OK: copy of 3004 bytes fits in 4096-byte cluster — no overflow

[AFTER2] defense-in-depth bound (reject dmalen+rxd > cluster):
  OK: oversize frame REJECTED before the copy — no overflow

verdict: the vulnerable m_getcl() path overflows; the patched m_getjcl()+bound path does not.
RUN_EXIT=0