== DF-3958 vtnet_rxeof_merged signed sub-buffer length ==
device used-ring len = 0x80000000
-- BEFORE-FIX (kernel code as-is) --
m_head.m_pkthdr.len = -2147483622 (<- 26 + negative)
m2->m_len           = -2147483648
BUG: mbuf with NEGATIVE m_len chained & delivered to if_input (if_vtnet.c:1670,1777)
m_copydata(m2,...): count=min(m_len,len)=-2147483648 -> (unsigned)0x80000000 -> bcopy of 2147483648 bytes => panic/smash (uipc_mbuf.c:1689-1690)
bpf_mcopy: walks into m2 data area reading stale cluster bytes into listener buffer (bpf.c:1280-1284)
first-buffer guards do NOT protect sub-buffers: if_vtnet.c:1707 len<26 check and :1964 clamp only run on the FIRST buffer
-- sweep (first-buffer len 26, sub len 0x80000000+k) --
sub_len=0x8000000e -> m2->m_len=-2147483634 pkthdr.len=-2147483608
sub_len=0x80000064 -> m2->m_len=-2147483548 pkthdr.len=-2147483522
sub_len=0x800003e8 -> m2->m_len=-2147482648 pkthdr.len=-2147482622
sub_len=0x80000800 -> m2->m_len=-2147481600 pkthdr.len=-2147481574
-- AFTER-FIX (unsigned clamp, fix.diff) --
m2->m_len=2048 (clamped to buffer m_len), pkthdr.len=2074 — sane chain, normal delivery