FAIL: no OOB read observed this run (retry)
DF-3537/DF-3538: ng_vjc VJ decompression OOB read (stale mbuf data leak)

[sanity] after legal 19-byte frame with checksum 0xC75D:
[sanity]   cstate th_sum = 0xC75D == 0xC75D OK  (mirror verified)

[oracle] 2-byte probes [40 01]: th_sum must be read from offsets 2,3
[oracle] which are PAST the 2-byte packet end; every non-zero value
[oracle] written into th_sum is out-of-bounds stale kernel data:
[oracle] 0/30 rounds leaked non-zero stale bytes via th_sum

[fields] 4-byte probes [67 01 00 00]: DECODE walk reads offsets 4..15;
[fields] any cstate delta-field change is OOB data, re-emitted by the
[fields] clean emit frame out the ip hook:
[fields] 0/30 rounds corrupted delta fields; 0 delivered out the ip hook

RESULT: sl_uncompress_tcp_core() reads past the end of short compressed
frames (no buflen checks in the DECODE walk or the mandatory th_sum read);
the out-of-bounds bytes persist in the VJ receive state and are disclosed
to the ip hook inside subsequently reconstructed TCP/IP headers.
EXIT=1