ECHO-A40F-FCBC-6816 Out-of-bounds write of one or two bytes when the printf builtin (and echo %b) converts a \u or \U Unicode escape into a multi-byte sequence. dash 0.5.12 has no \u or \U escapes. conv_escape() in src/bltin/printf.c handles only \\ \a \b \f \n \r \t \v and octal escapes; Debian's patch 0008-Support-e-in-echo-and-printf-builtins adds \e and nothing else. The Unicode-escape conversion arrived with upstream's "dollar single quote" work and was first released in dash 0.5.13. Trixie ships 0.5.12-12. MUST re-evaluate if trixie moves dash to 0.5.13 or later.