I'm on implementing of the CDC ECM (Ethernet over USB) and I have a few bugs that lead to overflowing of the pktbuf. Maybe someone can give a little clarity.
One problem occurs if a Router Solicitation from Linux host with the code 0 will be received. Then the l2src_len will be set to zero [1] and it leads to an error in [2], "gnrc_netdev2_eth: destination address had unexpected format" 😄 .

My current solution for testing is to skip _stale_nc in [1] if l2src_len is zero.
How to proceed with the ncache if the l2src_len is zero?
Should _send in gnrc_netdev2_eth.c release the pkt buffer in error case?

[1] https://github.com/RIOT-OS/RIOT/blob/master/sys/net/gnrc/network_layer/ndp/gnrc_ndp.c#L422
[2] https://github.com/RIOT-OS/RIOT/blob/master/sys/net/gnrc/link_layer/netdev2/gnrc_netdev2_eth.c#L185