m/M packets accept unbounded length overflowing 400-byte static I/O buffers

Summary

m (read memory) and M (write memory) packets trust attacker-supplied length int parsed by hexToInt() with no upper bound no rejection of negative values. For m mem2hex() writes 2*length hex bytes plus NUL into 400-byte static remcomOutBuffer; any length>200 corrupts adjacent kernel BSS until get_char hits unmapped page. For M hex2mem() reads 2*length bytes from pointer inside 400-byte remcomInBuffer reading past its end into adjacent BSS and writing resulting bytes to attacker-chosen kernel address. Crafted $m0 7fffffff overflows several GB past remcomOutBuffer through adjacent BSS until fault. hexToInt no negative rejection.