size overflow in ipv6_get_l4proto/br_dev_xmit, followed by memleak attempt