case                                RBC  bug_len    oob_B  fix_len    oob_B
normal 1500B packet                1504     1500     -546     1500     -546
max legal 1518B packet             1522     1518     -528     1518     -528
silicon long 8184B packet          8184     8180     6134       -1        0
RBC=0  (wrap to 0xFFFC)               0    65532    63486        0        0
RBC=1  (wrap to 0xFFFD)               1    65533    63488        0        0
RBC=3  (wrap to 0xFFFF)               3    65535    63490        0        0
RBC=4  (len=0)                        4        0    -2046        0        0

Buggy driver: 4/7 cases overflow the 2KiB mbuf cluster
Fixed driver : 4/7 cases accept & fit, rest rejected

CONFIRMED: missing upper bound on XE_RBC lets oversized packets (or RBC<4 unsigned wrap) overflow the 2048-byte mbuf cluster by thousands of bytes — heap corruption on every received long/runted packet, triggerable by an unauthenticated sender on the same L2 segment.
RUN_EXIT=0