# DF-3933 — age: single-segment RX frame length taken from return descriptor without clamp → m_len/m_pkthdr.len past the cluster (heap OOB read)

## Build / Run (on hardware)
Requires an Attansic L1 NIC (age(4)) whose RX return descriptor reports a
frame length larger than the receive buffer (malicious/buggy NIC, or a NIC
descriptor corrupted by DMA faults).  No user action beyond the interface
being up; the forged RRD arrives in the interrupt path.

Lab: QEMU model of the L1 writing `rx_rdesc->len = 0xFFFF<<16` with nsegs=1.

## Expected result
For a single-segment frame the driver sets
`m->m_pkthdr.len = m->m_len = sc->age_cdata.age_rxlen` — the raw 16-bit
hardware length — on an mbuf whose usable capacity is MCLBYTES-ETHER_ALIGN
(2046).  A length up to 65535 makes ether_input/BPF walk up to ~63KB past
the cluster: kernel heap contents get parsed as an Ethernet frame and can
surface in packet data (info leak) or panic the stack.

Hardware-gated (no L1 in the audit guest): source-certain, not
runtime-reproduced.  See VERDICT.md.  (Distinct from DF-1292, which is the
multi-segment desc->len path.)