NGM_SOURCE_GET_COUNTER reads msg->data without arglen validation heap OOB read

Summary

GET_COUNTER handler reads *(uint8_t*)msg->data to obtain counter index before checking message carries data. Every sibling command(START SETPPS SET_TIMESTAMP SET_COUNTER) validates arglen first GET_COUNTER is lone exception. struct ng_mesg has 0-length flexible data[] allocated sizeof(ng_mesg)+arglen. With arglen==0 data region zero bytes read lands 1 byte beyond allocation. File NOT built by default not in sys/conf/files netgraph7 block + line 743 ifq typo compile error. Latent.