PT-2026-108756

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap broadcast sink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure mod src param without any bounds check. In base subgroup meta cb the destination eleme...