One-byte out-of-bounds stack read in get_pkt_len when parsing DIAG header at end of buffer

Summary

get_pkt_len at uep.c:127 reads buf[1] when buf[0]==UEP_PACKET_DIAG(0x0a). In the while loop at :242-256, when sequence of complete packets consumes all but last byte of maximum-length transfer (len was 17), p can point to buf[16] with len==1. If buf[16]==0x0a, get_pkt_len(p) reads p[1]=buf[17] which is 1 byte past u_char buf[17] stack array (valid 0-16). 1-byte stack over-read. pkt_len value only influences partial-save vs discard decision; value never reaches userspace because uep_process_pkt rejects DIAG headers (0x0a&0xFE=0x0a!=0x80 at :154). Defense-in-depth/KMSAN concern only.