rsu: add a runtime TX buffer bound check for a kernel buffer overflowHEADmain

The rsu driver currently relies on a `KASSERT` to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without `INVARIANTS`, an oversized raw 802.11 frame can reach
`m_copydata()` and overwrite past that buffer, causing local kernel memory
corruption.

This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return `EMSGSIZE`, leaving the existing
caller cleanup paths responsible for freeing `m0`, `ni`, and the unused
transfer buffer.

Reachable via root / bpf access

Reviewed by:	bz, adrian
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D58898

0 files changed, 0 insertions, 0 deletions