- RADIUS truncated attribute header — rad_packet_recv() could read a 2-byte attribute Type+Length pair when only 1 byte remained in the declared attribute region, permitting an out-of-bounds read past the packet. (rad_packet_recv() also parsed attributes beyond declared packet length which has been resolved via T9282).
- DHCPv6 reply buffer bounds bypassed at deep relay nesting — reply-side option allocators option allocators calculate available capacity relative to the already-shifted inner-message pointer rather than the original allocation base. Therefore, even a relay packet within HOP_COUNT_LIMIT can make the allocators overestimate available space and permit out-of-bounds reply construction; the inner Relay-Message length field is also computed and byte-ordered incorrectly.
- DHCPv6 RELAY-FORW inner Relay-Message not validated — nested/inner Relay-Message option payloads inside a RELAY-FORW message are not checked for minimum length or for duplicate/missing Relay-Message options, allowing malformed relay chains to be processed.
- DHCPv6 Status-Code option under-length payload — print_status() read a 2-byte status code from an option whose declared length could be 0 or 1 byte, causing an out-of-bounds read.