Both findings are valid. V2 validates hdr->len before allocation and sizes the skb from the declared payload, which also avoids the 32-bit addition overflow. I am posting it as a separate thread per netdev policy. Thank you for the review.
pw-bot: cr
