Depth check lacks + 1 vs handleAlias; 10th stuff can advance os past optionStack[0..9] into adjacent poptContext fields (e.g. leftovers). Claimed LCE only if host uses corrupted poptGetArg* unsafely.

popt-1.18/src/popt.c:1671

Flow: Host repeatedly calls poptStuffArgs (and/or deep alias nesting) → overflow con->os → corrupt context → later poptGetArg / poptGetArgs / poptPeekArg → only if host sinks that string into exec/system/popen/dlopen (or equivalent).

Analysis has identified that this goes back to the git tag `popt-1_1_1`