BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  7752 Jul 18 18:12 df0521
well-formed: sun_len=14, pathoff=2 -> pathlen=12 (OK)
malformed:  sun_len=1, pathoff=2 -> pathlen=-1
            (size_t)pathlen = 18446744073709551615 bytes
            target buffer:   pathbuf[255+1] (stack)
            pathbuf[pathlen] = '\0' writes at stack offset -1
            => stack OOB write of ~18446744073709551615 bytes + neg-index write

Conclusion: code-path is genuinely vulnerable to sun_len<pathoff;
            reachable only via a kernel-produced malformed sockaddr.
            Fix: clamp pathlen to 0 when sun_len<pathoff (see fix.diff).