A client could set the DHCP maximum-message-size option to a large
value; dovend_rfc1048() derived the reply length from it with no upper
bound, so the trailing bzero() of the vendor area ran far past the
MAX_MSG_SIZE packet buffer. A value >= 0x8000 read into a signed short
instead went negative and slipped past the length clamps, leaving
sendto() to read a huge length from the buffer.
Read msgsz unsigned and clamp the reply length to the buffer size.