# DF-0997 — rum RX mbuf m_len heap OOB read

## Summary
`rum_bulk_read_callback` at `sys/bus/u4b/wlan/if_rum.c:1221` sets
`m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff` from a device-controlled
RX descriptor field. A malicious/faulty RT2573 USB adapter can advertise a
12-bit length up to 4095 even though only ≤2048 bytes were actually received
into the cluster. Subsequent readers walk off the cluster into kernel heap.

## Why not tested on default guest
No Ralink RT2573 USB WiFi adapter is attached to the QEMU guest and
`if_rum.ko` is not loaded. Reproduction requires USB HW passthrough or a
USB-gadget fuzzer — not available here.

## Fix
`fix.diff` bounds-checks the descriptor `pktlen` against both `len`
(host-controller-bounded actual transfer length) and `MCLBYTES`, dropping
the frame if bogus.

## Compilation check
The fix (applied together with DF-0998 and DF-0999) compiles cleanly into
`if_rum.ko` — see `module_build.log`.