OOB read: wg_output dereferences 4 bytes from mbuf without length check in BPF AF_UNSPEC path

Summary

wg_output(:2289) *(mtod(m,uint32_t*)) reads AF without checking m_pkthdr.len>=4. BPF DLT_NULL write of 0-3 bytes -> reads stale mbuf data. m_adj(m,4) on <4 byte packet -> m_len underflow. Root-only via /dev/bpf.