DF-3046 fix validation (A/B, same harness, same test, only bootp_subr.c changed)
===============================================================================

Kernel A (baseline):  bootp_subr.c sha256 ada7d13f... (verbatim gate OK)
Kernel B (fixed):     baseline + fix.diff (1 hunk: TAG_OVERLOAD must have
                      len == 1, else badopt=1 and the walk aborts at :1288),
                      sha256 52154f24f8d0f6fd8964d8cab366e81a377c5c10c622a7b3531c293d33be0148

Test 1 sub-results (planted-byte values in parentheses):

  T1a  len=0 TAG_OVERLOAD as final option of a region, guard byte 0xa5
       planted at ej:  baseline overload=0xa5 badopt=0  (OOB byte ADOPTED)
                       fixed    overload=0x00 badopt=1  (rejected)

  T1b  len=3 TAG_OVERLOAD, value bytes {2,7,9}:
       baseline overload=0x02 (first value byte taken, len ignored)
       fixed    badopt=1, overload stays 0

  T1c  len=0 at the final byte of a full-size reply (replylen=1460),
       guard 0x03 at bp+sizeof(struct bootp_packet):
       baseline overload=0x03 badopt=0  (byte past the struct read+adopted)
       fixed    badopt=1

  T1c2 replylen=1458, len byte is final byte of vend[] itself, tail-padding
       byte 0xee at bp+1458 (past the vend[1221] member):
       baseline overload=0xee
       fixed    overload=0x00 (no re-walk; value never adopted)

  T1d  valid TAG_OVERLOAD=SNAME in vend, then len=0 TAG_OVERLOAD as final
       two bytes of sname[64], file[0] planted 0x5c:
       baseline overload=0x5c (== planted adjacent field bp->file[0])
       fixed    overload=0x02 (the LEGITIMATE vend option value only; the
                OOB read of file[0] no longer happens)

  T1e  same with file[0]=0x77: baseline 0x77 / fixed 0x02 (constant -- no
       tracking of the planted byte)

  T1f  TAG_OVERLOAD=FILE in vend, len=0 at final two bytes of file[128]:
       baseline overload=0x77 via a CHAINED double OOB (file walk reads
       bp->vend[0]=99 first; 99 has the SNAME bit set, so the sname walk
       then runs and adopts bp->file[0]=0x77)
       fixed    overload=0x01 (legitimate value only)

Verdict: after the fix, no zero-length or wrong-length TAG_OVERLOAD is ever
consumed, no byte outside the parsed region is read for the overload flag,
and only well-formed len==1 overload options steer the file/sname re-walks.