Missing minimum-length check + u_short packetlen underflow in LMI packet parser kernel heap OOB read

Summary

LMI_MIN_LENGTH=8 defined(:88) but never used. Neither nglmi_rcvdata nor nglmi_checkdata enforces minimum packet length. Loop variable packetlen is u_short while STEPBY macro(:544-548) does unchecked packetlen-=step. 0-4 byte mbuf surviving byte-by-byte header checks causes packetlen wrap from 0 to 65535 then IE-parsing loop while(packetlen>=2) walks data far past mbuf storage into adjacent kernel heap. m_pullup check :576 dead (m_len<packetlen identically false). STEPBY(1) at :757/:783/:791/:806 consume bytes past valid. Per-iteration reads data[0]/data[1] become silent OOB reads ~85 iterations past MHLEN~172. No info leak logs bounded m_len no controlled write.