A QEMU guest can make the Realtek NIC read past a short packet
Brief
This is not an isolation escape.
Notes
59fc7b747d56652e09708adff3afaca326e85a2a (Peter Maydell). Drop leftover short-frame padding so a loopback VLAN tag cannot read 4 bytes past the buffer. Resolves #3518 (Kind::Bug, closed 2026-08-16).
Landed via 9696bf5dc5a5bf0b4a9d05b6cdfe5f13990f97aa (Merge tag hw-misc-20260816, 2026-08-16). On master. Not in v11.1.0. Loopback only.
No CVE on the ticket or the commit. Do not invent one. Do not republish the issue attachment.
Commit 59fc7b747d56652e09708adff3afaca326e85a2a