Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. "_nx_mdns_packet_rr_add" (nxd_mdns.c:8911) sizes its only bound check from that stale length, and "_nx_mdns_name_string_encode" writes the real string. Two PTR records are enough, both ordinary mDNS responses to a "_http._tcp" query, with owner names whose lengths fall in the same bucket: The overflow is one to three bytes of attacker-influenced name data past "nx_packet_data_end". In a normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash. Compare the slot size against the stored string length before declaring a match, or keep the string length in the slot header and return it to the caller so the encoder and the bound check agree.