#tun

Kernel closes virtio GSO bypass that skipped flow dissection

Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.