DF-4067 model: ti_rxeof trusts NIC-DMA'd u16 ti_len (if_ti.c:1690) with no bound vs buffer size

std   (MCLBYTES cluster)     usable=2046  firmware-legit max=1518  claim max=65535 -> OOB read up to 63489 bytes past buffer
mini  (MHLEN mbuf hdr area)  usable=222   firmware-legit max=222   claim max=65535 -> OOB read up to 65313 bytes past buffer
jumbo (TI_JLEN slot)         usable=9022  firmware-legit max=9018  claim max=65535 -> OOB read up to 56513 bytes past buffer

std ring detail: m_len=65535 on 2048B cluster -> m_copydata/BPF read 65535 bytes starting at data(+2): 63489 bytes OOB (16x the cluster)
jumbo ring detail: m_len=65535 on 9024B slot -> 56513 bytes OOB; slot pool block = TI_JSLOTS*TI_JLEN = 3465216 bytes, so claims beyond the block read past the contigmalloc region

RC_DF4067_MODEL=0
RC=0