SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields, each up to 65535, directly from an attacker-controlled SCTP SACK chunk and loops that many times reading four bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A single crafted SACK chunk from a negotiated WebRTC peer forces reads past the end of the 262144-byte receive buffer, raising IndexOutOfRangeException, which is not caught by the recoverable handler and terminates the dedicated SCTP receive thread, permanently killing the SCTP association and all data channels. Fixed in 10.0.14, which validates the counts against the declared chunk length and treats the failure as recoverable.