You are right, the impact statement does not hold up: the reused buffer still contains a previously valid control message, so a short packet makes the driver parse stale - not attacker-controlled - data, and that is not worth carrying an extra check for. Please drop this patch.
Sorry for the noise, and thanks for the review.
