re_rar_set reads 2 bytes past 6-byte MAC buffer via u_int32_t cast (benign OOB stack read)

Summary

re_rar_set at re.c:3903-3904 does CSR_WRITE_2(sc, RE_IDR4, htole16(*(u_int32_t *)(&eaddr[4]))) - a 4-byte load from offset 4 of a 6-byte ETHER_ADDR_LEN buffer. Reads indices 4,5,6,7 = 2 past end. On DragonFly reachable via rtl_get_hw_mac_address -> re_get_hw_mac_address -> re_rar_set where eaddr is 6-byte stack local from if_re.c:600. 4-byte value immediately truncated to 16 bits by htole16 so over-read bytes discarded - no info leak, no integrity impact, no crash on x86 (unaligned tolerated). UB and latent hardening defect only. Fix: replace type-punning with explicit byte assembly.