Wrong TX frame-size bound causes 16-byte overflow of USB DMA buffer

Summary

rum_bulk_write_callback bounds outgoing mbuf length with if(m->m_pkthdr.len > (int)(MCLBYTES + RT2573_TX_DESC_SIZE)) and clamps to same value. Bound wrong: USB DMA buffer is MCLBYTES+RT2573_TX_DESC_SIZE+8=2080 bytes descriptor occupies first 24 bytes leaving only MCLBYTES+8=2056 bytes for frame. Check permits up to 2072 bytes so usbd_m_copy_in writes up to 16 bytes past end of page cache. usbd_copy_in/usbd_m_copy_in no internal bounds checking. Worse guard truncates m_pkthdr.len instead of dropping so 2346-byte 802.11 max-size frame becomes 2072-byte one still overflows by 16 bytes. Frames 2057..2072 bypass guard entirely. Sibling if_run.c:3091-3097 correct bound and DROP. Privileged user (CAP_NET_RAW/bpf monitor-mode vap) can submit raw 802.11 frames via rum_raw_xmit.