# DF-0998 — rum TX DMA buffer 16-byte overwrite

## Summary
`rum_bulk_write_callback` at `sys/bus/u4b/wlan/if_rum.c:1057-1065` clamps
`m->m_pkthdr.len` to `MCLBYTES + RT2573_TX_DESC_SIZE = 2072`, then writes
the mbuf payload at offset `RT2573_TX_DESC_SIZE = 24`. End offset =
24 + 2072 = 2096, but the DMA buffer is only 2080 bytes → **16-byte
overwrite**.

## Why not tested on default guest
No RT2573 USB adapter on the QEMU guest. `if_rum.ko` is not loaded.
Trigger requires USB HW or USB-gadget emulation.

## Fix
`fix.diff` changes the clamp to `MCLBYTES` (the correct upper bound for
the mbuf payload portion of the buffer).

## Compilation check
Compiles cleanly into `if_rum.ko` (see `module_build.log`).