A fifth length byte: integer overflow and a signed syscall compare in Zephyr RTOS
A greater-than that should have been a greater-than-or-equal lets a remote MQTT packet pick any 32-bit length it likes, and a signed branch instruction lets a user thread pick any function pointer it…
found by Ilya Zhuravlev and Jeremy Boone, NCC Group