DLCI array access lacks local bounds check — ng7 twin of DF-0556

Summary

ng7 twin of DF-0556. nglmi_rcvdata DLCI IE handler segsize==6 GROUP4: dlci=(data[2]<<8)|data[3] yields 0-65535(:690-691). Empty if(dlci<1024&&dlci>0) with XXX comment(:692/699). Falls through to sc->dlci_state[dlci] read(:709) write(:716). dlci_state[MAXDLCI+1=1024]. Safety entirely depends on nglmi_checkdata rejecting dlci>1023(:962). Print path(:977-980) returns 1(accept) bypassing some IE-ordering checks. Fix: if(dlci>MAXDLCI) goto nextIE in rcvdata.