EUVD-2026-66555

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...