Changes

trx_data_read_cb(): make length checks waterproof

Header lengths are defined in two places:
- trx_data_rx_hdr_len[],
- rc of trx_data_handle_*().

Before this patch, we used the one to validate the length, and the other
to read the buffer data.

Use only the trx_data_rx_hdr_len[] values for validation as well as
reading.

Make sure that any (successful) return values exactly match the header
length that was valiated earlier.

Use a separate rc variable (of the more fitting int type) for the
function calls, and keep only one unchanging hdr_len from the start.

Related: CID#465552
Change-Id: Ic658824a5884598d1245511897bcc00050c14317