# DF-0269 PoC — sppp_print_bytes VLA stack overflow

## Build
```
cc -o sppp_vla sppp_vla.c
```

## Run
```
./sppp_vla
```

## Expected
Code-path confirmation harness demonstrating the size mismatch: VLA allocates
`len` bytes but hexncpy writes `3*len` bytes (2*len overflow). A live trigger
requires a sppp-based interface (PPPoE/sync-serial) with IFF_DEBUG and a peer
sending an LCP frame.