Stack out-of-bounds read via unchecked fragment offset

Linux 6.14 permits a stack out-of-bounds read in IP-TFS reassembly when context-dependent attackers send crafted AGGFRAG payloads. In iptfs_skb_can_add_frags(), an unchecked offset reaches iptfs_skb_reset_frag_walk(), which advances beyond the on-stack fragment array without checking nr_frags. Exposure requires an inbound IPTFS security association and a payload that passes IPsec processing; the demonstrated consequence is a kernel stack out-of-bounds read, not established code execution or disclosure.