No re-validation of m_len>=hlen after pfil hook rewrite/dummynet re-entry

Summary

After pfil_run_hooks(:631) rewrites packet, hlen re-derived from ip->ip_vhl(:635) with no m_len check or pullup. ip_dooptions(:661) walks hlen-20 option bytes. Buggy pfil hook with inconsistent ip_vhl/m_len -> OOB read in option loop. Requires pfil module defect, not reachable via crafted packets alone.