CVE-2026-18415 Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...