config                  total_len      coalesce?     result
16x1                           16             no       OOB!
16x2                           32             no       OOB!
16x3                           48             no       OOB!
16x4                           64             no  in-bounds
15x1                           15             no  in-bounds
17x1                           17            yes  in-bounds

Buggy configs: 3/6 write past wb_frag[15]
CONFIRMED: wb_encap writes 12+ bytes (wb_ctl/wb_data/wb_status) past the end of struct wb_txdesc (wb_frag[16..]) when the chain has exactly 16 non-empty mbufs summing to < 60 bytes, plus a 4-byte RMW via WB_TXCTL(c). On real hardware this corrupts adjacent kernel heap (or the next contiguous wb_txdesc when wb_ptr==wb_tx_list[127]).
RUN_EXIT=0