fix.diff — DF-4268: stop re-fetching the device-written RX status word.

Use the rxstat snapshot taken at the top of the loop (if_wb.c:973) for the
length checks and the length use, instead of re-reading wb_status (device DMA
memory) three more times. Prevents a check/use TOCTOU where a device rewrite
of the 14-bit length field between check (>1536 rejected) and use yields
total_len up to 16383, and m_devget() then bcopy()s up to 16385 bytes from a
4096-byte static RX buffer (OOB read of ~12KB into the received mbuf).

Applies on top of sys/dev/netif/wb/if_wb.c (read-only audit tree; never applied).

--- a/sys/dev/netif/wb/if_wb.c
+++ b/sys/dev/netif/wb/if_wb.c
@@ -979,9 +979,9 @@ wb_rxeof(struct wb_softc *sc)
 		m = cur_rx->wb_mbuf;
 
 		if ((rxstat & WB_RXSTAT_MIIERR) ||
-		    (WB_RXBYTES(cur_rx->wb_ptr->wb_status) < WB_MIN_FRAMELEN) ||
-		    (WB_RXBYTES(cur_rx->wb_ptr->wb_status) > 1536) ||
+		    (WB_RXBYTES(rxstat) < WB_MIN_FRAMELEN) ||
+		    (WB_RXBYTES(rxstat) > 1536) ||
 		    (rxstat & WB_RXSTAT_LASTFRAG) == 0||
 		    (rxstat & WB_RXSTAT_RXCMP) == 0) {
@@ -1001,7 +1001,7 @@ wb_rxeof(struct wb_softc *sc)
 		}
 
 		/* No errors; receive the packet. */	
-		total_len = WB_RXBYTES(cur_rx->wb_ptr->wb_status);
+		total_len = WB_RXBYTES(rxstat);
 
 		/*
 		 * XXX The Winbond chip includes the CRC with every