Several if_output implementations (tuntap, me, gif, disc, loop) read
dst->sa_data into an address family variable via bcopy/memcpy without
verifying that dst->sa_len >= sizeof(af) first. When called via
bpfwrite() with DLT_RAW, dst is zero-initialized and sa_len is 0,
resulting in af=0 passed silently to BPF_MTAP2.
Add an explicit sa_len check before the copy. If sa_len is
insufficient, af defaults to 0 rather than reading beyond the
valid buffer range.
MFC after: 2 weeks