[followup] ParseACK lacks a fragment guard (filter is the only defense)

open   by a73x

Labels: backlog

[claude 2026-08-14] Found during T1 rework on per-vm-networks: ParseACK reads UDP ports at 4*IHL without checking fragment offset 0, so a crafted continuation fragment that decodes as 67->68 + valid DHCP is believed by the parser; the cBPF fragment line (attached before bind, always present in-tree) is what stops it. Pinned by TestFilterDropsFragmentsThatFoolTheParser. Reachability today is nil beyond the neighbour leg the bridge sport-67 rule closes. Belt-and-braces fix is a ~2-line flags/offset check in ParseACK; the test frame already exists.