DF-4024 re_rxeof length-trust geometry model
descriptor GFRAGLEN field       : 14 bits, max 16383
RX cluster (re_newbuf_std)     : 2048 bytes (MCLBYTES)
single-frag EOF m_len lie      : 16383 - 4 = 16379
  -> heap OOB read past cluster: 14331 bytes
multi-frag k=1: pkthdr.len 16379 > chain 2048 -> m_copydata walks m_next past NULL (+14331)
multi-frag k=2: pkthdr.len 16379 > chain 4096 -> m_copydata walks m_next past NULL (+12283)
multi-frag k=3: pkthdr.len 16379 > chain 6144 -> m_copydata walks m_next past NULL (+10235)
multi-frag k=4: pkthdr.len 16379 > chain 8192 -> m_copydata walks m_next past NULL (+8187)
multi-frag k=5: pkthdr.len 16379 > chain 10240 -> m_copydata walks m_next past NULL (+6139)
multi-frag k=6: pkthdr.len 16379 > chain 12288 -> m_copydata walks m_next past NULL (+4091)
multi-frag k=7: pkthdr.len 16379 > chain 14336 -> m_copydata walks m_next past NULL (+2043)
total_len<4 sub-case           : negative m_len, dropped by ether_input m_len<ETHER_HDR_LEN guard (SAFE)
precondition                   : device-DMA'd descriptor lie (faulty/malicious NIC); guest has no re(4) device
RC_4024=0