uether_rxmbuf() sets m_len/m_pkthdr.len from the caller-supplied len with no clamp — the core's unguarded RX entry point (live instance: DF-5396 urndis 2-byte heap overflow)

Summary

Asymmetric validation: rxbuf rejects out-of-range len but rxmbuf blindly sets m_len from a driver/device-supplied len with no check against the mbuf capacity, and usbd_copy_out is unbounded against the page cache - the one live overflow (urndis DF-5396, upstream-fixed 11 years ago) came through exactly this entry point; the core API guarantees nothing for future callers. M_TRAILINGSPACE-clamp fix.