Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public "cs_disasm()" and "cs_disasm_iter()" APIs. For a large but well-formed "br_table" instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a "uint16_t" instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and "cs_disasm()" can repeatedly decode the same instruction without advancing. For larger lengths, "cs_disasm_iter()" advances into the middle of the "br_table" payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.