BUILD_OK
DF-3759 model of alc_rxeof (if_alc.c:3368-3386), alc_buf_size=1536, cluster=2048

[leak] rxlen=16383 (RRS 14-bit max), nsegs=1 (device-controlled):
    m[0].m_len=16379   (cluster 2048)   <-- OOB READ BEYOND CLUSTER
    => pkthdr.len=16379 vs 2048-byte cluster: ~14.3KB heap OOB read,
       payload copyable to an unprivileged socket

[underflow] rxlen=0, nsegs=1:
    m[0].m_len=-4      (cluster 2048)   <-- NEGATIVE m_len
    => pkthdr.len=-4 (int underflow)

[negative m_len] rxlen=100, nsegs=15:
    m[0].m_len=1536    (cluster 2048)
    m[1].m_len=1536    (cluster 2048)
    m[2].m_len=1536    (cluster 2048)
    m[3].m_len=1536    (cluster 2048)
    m[4].m_len=1536    (cluster 2048)
    m[5].m_len=1536    (cluster 2048)
    m[6].m_len=1536    (cluster 2048)
    m[7].m_len=1536    (cluster 2048)
    m[8].m_len=1536    (cluster 2048)
    m[9].m_len=1536    (cluster 2048)
    m[10].m_len=1536    (cluster 2048)
    m[11].m_len=1536    (cluster 2048)
    m[12].m_len=1536    (cluster 2048)
    m[13].m_len=-19872  (cluster 2048)   <-- NEGATIVE m_len
    m[14].m_len=-21404  (cluster 2048)   <-- NEGATIVE m_len
    => negative m_len survives into the delivered chain; mbuf walkers
       (m_pullup/m_adj/m_copydata) violate invariants -> panic

Real trigger path (needs AR8131/8132/8151/8152/816x/817x hardware):
  device writes RRS{RRD_VALID, rd_cnt=1, bytes=16383} with no error bits
  -> alc_rxintr (if_alc.c:3236) -> alc_rxeof (if_alc.c:3293)
  -> m handed to if_input (if_alc.c:3400) describing 16379 bytes in a
     2048-byte cluster.
TRIGGER_RC=0