drivers/slipdev: fix off-by-one error in _recv()

[benpicco]

Contribution description

If the number of written bytes is greater than the length of the buffer, we have already written out-of bounds memory.

With pktbuf this means we will likely have corrupted the next free list entry.

Testing procedure

Issues/PRs references

[miri64]

Agreeing with @kfessel.

[benpicco]

Like this?

btw what's up with that _recv function? Why does it have a special case to drop len bytes if buf is NULL? This is the only driver I'm aware of that does that, and I can't think of a use case for when this would be useful.

[benpicco]

Hm a

sudo ping -A ff02::1%sl0

still kills it

[benpicco]

Ah the adaptive ping issue is unrelated. I was testing this on a nrf52840dk with examples/gnrc_border_router, so gnrc_netif_pktq is used

> ping ff02::1
error: packet buffer full
error: packet buffer full
error: packet buffer full

-> #17924

[benpicco]

closed in favor of #18826