AIKIDO-2026-606890

TL;DR

The built-in TCP/IP stack's neighbor discovery handlers access fixed offsets in ICMPv6 neighbor advertisement and solicitation messages without confirming the payload is large enough. Short packets cause out-of-bounds heap reads of up to twenty-two bytes past the receive buffer. An unauthenticated peer on the same network segment can crash the device through the over-read of adjacent memory. The fix adds the missing minimum-length checks.