== BEFORE-FIX (vulnerable) ==
BUG: len=2147483646(0x7ffffffe) + pad(2) wraps to -2147483648(0x80000000) ; while(len>0) skipped -> m_prev==NULL -> KASSERT/NULL deref
== AFTER-FIX ==
FIX: len > VTNET_MAX_RX_SIZE + hdr_size(65560) -> packet dropped, if_ierrors++