PT-2026-68994

ReadDir and ReadDirPlus parse the QUERY DIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int...