ipfw: pull up only the headers ipfw_chk() inspects

[netchild]

Summary

The layer-2 hook (net.link.ether.ipfw) runs ipfw_chk() on the raw
Ethernet frame, which pulled up min(m_pkthdr.len, max_protohdr) bytes to
make the L2 and L3 base headers contiguous. A sender advertising
IFCAP_MEXTPG hands it an unmapped (M_EXTPG) sendfile(2) or KTLS chain
whose mapped head is 54 bytes; max_protohdr is 60, so m_pullup() walked
six bytes into the unmapped mbuf and dereferenced a NULL mtod(),
panicking the kernel.

Pull up only the Ethernet plus the largest L3 base header ipfw reads
inline; deeper headers are already pulled up on demand. This is the same
fix as bridge_pfil().

Assisted-by: Claude Code (Fable 5)

[netchild]

This is the the same issue as in D59332 (bridge).

[glebius]

Ok, this mess mostly comes from me. While reviewing this patch I came to alternative that I will post soon.

[netchild]

In D59389#1362863, @glebius wrote:

Ok, this mess mostly comes from me. While reviewing this patch I came to alternative that I will post soon.

Do you agree that I can abandon this revision?

[glebius]

In D59389#1362895, @netchild wrote:

In D59389#1362863, @glebius wrote:

Ok, this mess mostly comes from me. While reviewing this patch I came to alternative that I will post soon.

Do you agree that I can abandon this revision?

Please don't rush yet, before I post mine. Will check if it passes your test case at least :)

[glebius]

Alternative https://reviews.freebsd.org/D59426 I will also see if the new PULLUP() can be used everywhere down below the function to easily get typed pointers with guaranteed memory length provided.