fsm_readopt() advanced the decode cursor by the option length without
checking it against the end of the packet. A crafted LCP/CCP/IPCP
option could then make the Config-Reject/Nak echo copy past the
received packet into adjacent heap, disclosing heap bytes to the peer
before authentication.
Check the option framing once in fsm_Input() and drop the packet before
decoding per RFC1661