SETIFACE passes non-NUL-terminated msg->data to ifunit bounded heap OOB read

Summary

NGM_SOURCE_SETIFACE hands user-controlled message buffer to ifunit() with only arglen<2 length check. ifunit() compares strncmp(ifp->if_xname name IFNAMSIZ) reads up to 16 bytes. If name shorter than IFNAMSIZ and not NUL-terminated strncmp reads (16-first_nul_pos) bytes past intended message data. With arglen=2 no NUL reads 14 bytes past allocation into heap-adjacent ng_mesg. Bytes only feed comparison not returned. Latent file not built by default.