CVE-2026-102758: C Buffer Read Before Nonempty Length Guardcve-2026-102758-c-buffer-read-before-nonempty-length-guard
$BUF is read at $BUF[$IDX] before the "at least one byte remaining" guard `if (*$LEN < 1)` executes. When a caller passes a zero remaining length the guard correctly rejects the input, but the load of $BUF[0] has already happened one byte past the end of the buffer, producing a one-byte out-of-bounds read (CWE-125) on attacker-controlled parser input such as
