tun: validate GSO checksum offset fits within HdrLen

[illotum]

GSOSplit only bounded the checksum offset against the input packet length, not against HdrLen. With CsumStart+CsumOffset+2 > HdrLen, the per-segment output buffer (sized to HdrLen+segmentDataLen) is too short and writing the transport checksum panics with an index out of range.
Reject the options up front instead.

[Copilot]

Pull request overview

Adds a bounds check in GSOSplit to reject GSO options where the checksum field (CsumStart + CsumOffset + 2) extends past HdrLen, preventing an index-out-of-range panic when writing the per-segment transport checksum into a buffer sized to HdrLen + segmentDataLen. Also normalizes fuzzer inputs to conform to the virtio_net_hdr contract so Fuzz_GSOSplit exercises the split logic instead of hitting shapes the kernel never produces.

Changes:

• Validate CsumStart + CsumOffset + 2 <= HdrLen early in GSOSplit and return a descriptive error otherwise.
• In Fuzz_GSOSplit, clamp CsumStart and HdrLen to minimum IP/transport header sizes per GSO type, and skip cases where the packet is shorter than the resulting HdrLen.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tun/offload.go	Adds the new CsumStart+CsumOffset+2 > HdrLen validation in GSOSplit.
tun/offload_test.go	Normalizes fuzzer-generated GSOOptions to match kernel virtio_net_hdr expectations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[illotum]

@jwhited The other guards will be added in #62 where they were observed.

[jwhited]

The bounds check LGTM.

We should add the associated corpus entry to the fuzz test.