CVE-2026-8836: Lwip Snmp Asn1 Dec Raw Aliased Length And Bufmaxcve-2026-8836-lwip-snmp-asn1-dec-raw-aliased-length-and-bufmax
Call to snmp_asn1_dec_raw passes the same expression as both the read-length (2nd argument) and the destination buffer maximum length (5th argument). snmp_asn1_dec_raw's internal bounds check is `if (len > buf_max_len) return ERR_MEM;` so identical arguments make the guard a no-op, allowing an attacker-controlled ASN.1 OCTET STRING length (e.g. msgAuthentica
