IEEE80211_MAX_LEN (dr_rx_bufsize) = 2312
MCLBYTES (actual cluster)         = 2048
frameoffset                       = 30
usable frame_len for a 2048 cluster = MCLBYTES - frameoffset = 2018

frame_len=1500   check(len<=2312)=PASS(drop->keep)  m_len=1530  cluster_overrun=0    
frame_len=2018   check(len<=2312)=PASS(drop->keep)  m_len=2048  cluster_overrun=0    
frame_len=2019   check(len<=2312)=PASS(drop->keep)  m_len=2049  cluster_overrun=1    >>> HEAP OOB READ past 2048-byte cluster
frame_len=2048   check(len<=2312)=PASS(drop->keep)  m_len=2078  cluster_overrun=30   >>> HEAP OOB READ past 2048-byte cluster
frame_len=2100   check(len<=2312)=PASS(drop->keep)  m_len=2130  cluster_overrun=82   >>> HEAP OOB READ past 2048-byte cluster
frame_len=2312   check(len<=2312)=PASS(drop->keep)  m_len=2342  cluster_overrun=294  >>> HEAP OOB READ past 2048-byte cluster
frame_len=2313   check(len<=2312)=DROP  m_len=2343  cluster_overrun=295  

concrete model (frame_len=2100): consumer reads 2048 in-bounds + 82 OOB bytes
  the 82 OOB bytes are adjacent heap (here modeled 0xBB); in-kernel these are leaked into the delivered frame payload

result: 4/7 frame_len values pass the kernel check but overrun the 2048-byte cluster
DF-1131: CONFIRMED heap OOB read primitive (up to 294 bytes past cluster)

--- WITH FIX (drop if len+frameoffset > MCLBYTES) ---
frame_len=1500   keep=keep  cluster_overrun=0 (clean)
frame_len=2018   keep=keep  cluster_overrun=0 (clean)
frame_len=2019   keep=DROP  cluster_overrun=0 (dropped, safe)
frame_len=2048   keep=DROP  cluster_overrun=0 (dropped, safe)
frame_len=2100   keep=DROP  cluster_overrun=0 (dropped, safe)
frame_len=2312   keep=DROP  cluster_overrun=0 (dropped, safe)
frame_len=2313   keep=DROP  cluster_overrun=0 (dropped, safe)
FIX result: 0 OOB cases remain (expect 0)
DF-1131 FIX: VALIDATED - cluster-bound guard drops all overrun frames
RUN=0