do_config() checks that each command's o.len fits in the remaining
buffer, but the DN_LINK, DN_PROFILE, DN_SCH and DN_FS cases then copy a
fixed sizeof(struct) out of the command, which can be larger than o.len.
A command with o.len == sizeof(struct dn_id) reads past the end of the
sockopt buffer (DN_PROFILE copies about 4 KB).

Reject a command whose o.len is shorter than the structure it carries.
Add a test.

Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <ojanerif@amd.com>

tests/sys/netpfil/common/dummynet_config_test.c sends a minimal
IP_DUMMYNET3 command for each of DN_LINK, DN_PROFILE, DN_SCH and DN_FS
with oid.len == sizeof(struct dn_id).

On a GENERIC-KASAN kernel in a bhyve guest the unpatched dummynet(4)
panics on the first case (ASan: Invalid access, 32-byte read in
do_config()). With this change all four cases return EINVAL and the
test passes.