DF-3989 — ale_rxeof trusts the controller-DMA'd 14-bit RRS frame length with
no bound vs the Rx page / ale_max_frame_size: m_devget copies up to 16379
bytes from a DMA page of 198144 (non-jumbo) / 204768 (jumbo) bytes → heap
OOB read of up to ~14.8KB of adjacent kernel memory, delivered to the
network stack (kernleak). DF-3604 (bce) / DF-3759 (alc) / DF-3933 (age)
family, ale(4) instance. NOTE: unlike bce/alc, the length<4 underflow is
SAFE here (m_devget(int tot<=0) returns NULL → drop).

BUILD
    cc -O2 -Wall -Wextra -o trigger trigger.c

RUN
    ./trigger      (page-geometry model; prints OOB extents)

On the audit guest: builds and runs clean (run.log). Hardware-gated: guest
has virtio-net only; if_ale is compiled into the kernel but no 1969:1026
device exists (env.txt).

EXPECTED
    "non-jumbo ... OOB READ past DMA page: 14819 bytes"
    "jumbo     ... OOB READ past DMA page: 8195 bytes"
    TRIGGER_RC=0.