Kernel crash via unchecked netdevice private-data dereference

Out-of-bounds read in Linux kernel DSA code allows local users to crash the kernel via a VLAN-over-dummy interface event. The dsa_user_prechangeupper path calls dsa_user_to_port before confirming that a notified netdevice is a DSA user device, so p->dp reads eight bytes from invalid private storage on a zero-private-data dummy device. Triggering the fault requires local privileges to create and link network interfaces; the demonstrated consequence is a kernel oops and service interruption, not data access or modification.