The rsu driver currently relies on a KASSERT to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without INVARIANTS, an oversized raw 802.11 frame can reach
m_copydata() and overwrite past that buffer, causing local kernel memory
corruption.
This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return EMSGSIZE, leaving the existing
caller cleanup paths responsible for freeing m0, ni, and the unused
transfer buffer.
Reachable via root / bpf access