tested this CVE with 32-bit on 4.9.3, and it seems to be fixed

[tcpdump] / tests / aoe-oobr-1.out

AoE length 18, Ver 1, Flags: [Response, MBZ-0x02, MBZ-0x01]
        Major: 0x40f6, Minor: 0x02, Command: Reserve/Release, Tag: 0x01010101
        RCmd: Set reserve list, NMacs: 1 [|aoe]