Fix the bounds check in a frame walker

A C parser walked the frames in a packet with a signed length byte. A fuzzer found an infinite loop on a length of 0xFF, read as -1, and out-of-bounds reads near the end of the buffer. The fix reads the length as unsigned and stops at the first frame that cannot be parsed safely.

An assistant wrote walk_frames(buf, total). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• buf: the packet's bytes, as a list of integers from 0 to 255.
• total: how many bytes of buf are valid, as the caller reports it.
• Return the length of every frame parsed, in order.

Rules the tests check:

• The valid region is the first total bytes, but never more than the length of buf and never less than 0.
• A frame is one length byte, then that many payload bytes. Frames follow each other from index 0.
• Stop at the first frame whose length byte is 0, because it would never move the cursor forward.
• Stop at the first frame whose length byte and payload do not both fit inside the valid region.
• Stop at the end of the valid region. Return the lengths of the frames parsed before stopping.