== DF-3283 baseline run ==
1-3: same fw.ko hostap bring-up as DF-3282
4. sysctl kern.fw_fire=1  -> pushes one 5000-byte 802.3 frame through the real
   exported TX entry ieee80211_vap_pkt_send_dest() (same privilege as a BPF write;
   bypasses only ifnet-MTU accounting, the sole gate keeping >4KB frames out)



login: fw: fake wifi radio attached (fw0)
wlan0: MAC address: 02:00:00:00:00:f1
fw: wlan0 RUN, beacon allocated
fw0: need multicast update callback
fw0: need multicast update callback
fw.fire: vap wlan0, pushing 5000 byte frame (fragthreshold 2346)
panic: fragment size 2346 too big!
cpuid = 4
Trace beginning at frame 0xfffff801183ff638
ieee80211_encap() at ieee80211_encap+0xb01 0xffffffff80782371 
ieee80211_encap() at ieee80211_encap+0xb01 0xffffffff80782371 
ieee80211_vap_pkt_send_dest() at ieee80211_vap_pkt_send_dest+0xb1 0xffffffff80782801 
fw_fire_sysctl() at fw_fire_sysctl+0x1e5 0xffffffff82600235 
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06 
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1 
Debugger("panic")

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 
== DF-3283 PATCHED validation (kernel #1 Sep 10 04:41:20, fix.diff
   MCLBYTES-1 clamp applied) ==
sysctl kern.fw_fire=1   (twice)
   -> fw.fire: vap wlan0, pushing 5000 byte frame (fragthreshold 2346)
   -> fw.fire: returned (no panic)          x2
vm.sh status => up
(intermediate attempt with clamp==MCLBYTES still panicked with
 'fragment size 2048 too big!' - KASSERT is strict '<'; corrected.)