Summary

musycc_rcvmsg hands the raw NGM_TEXT_CONFIG payload to musycc_config without verifying NUL-termination; the ng control-socket path copies exactly len bytes into kmalloc(len+1) WITHOUT zeroing the sentinel byte, so a payload that fills the allocation is an unterminated string. musycc_config then runs unbounded strcmp/strtol over it - the walk continues into adjacent heap while zeros persist, and the creg branch reads set[5..] even when arglen==4. Distinct from DF-1499 (response-buffer overflow; this is the request-data read). memchr-NUL + sentinel-byte fix.