TAG_OVERLOAD consumed without length validation — zero-length overload option at the end of an options region reads one byte past the region and adopts an arbitrary overload value

Summary

In bootpc_tag_helper the overload option's value is taken as tctx->overload = *j with no check that its length byte is 1. Two consequences: (1) a TAG_OVERLOAD with len != 1 sets the overload flag from the first value byte regardless (RFC 2131 requires len==1); (2) with len == 0 positioned so its length byte is the final byte of the region, the guard admits it and *j reads one byte past the end of the parsed region (for the vend walk the first byte past struct bootp_packet's last member — still inside the parent kmalloc'd ifctx allocation; for the file/sname walks it lands on adjacent in-struct fields). The read value only steers which additional bounded areas get re-walked — no leak, no corruption, no crash demonstrated. Same netboot threat model as DF-0802. Fix: require len == 1 for TAG_OVERLOAD (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of bootp_subr.c (GLM 5.3).