Dead empty-body bounds check on DLCI in nglmi_rcvdata case 6 protected only by nglmi_checkdata

Summary

nglmi_rcvdata segsize==6 branch IE type 0x07/0x57 dlci computed as 16-bit value then if((dlci<1024)&&(dlci>0)) evaluated but body just XXX comment so dlci never bounded locally. dlci_state[dlci] accessed :709/:716 with dlci up to 65535. dlci_state u_char[1024] so [1024-65535] OOB read+write. NOT currently exploitable nglmi_checkdata:962 rejects dlci>1023 before second pass GROUP4 stickiness same data both passes. Defense-in-depth latent-bug single invariant in separate function prevents Critical.