Buffer growth maxargvlen*2 can under-allocate relative to accumulated argvlen, yielding small heap overflow (~11 bytes / ~9 attacker-chosen) on crafted config content.

Flow: Privileged or unprivileged host loads attacker-influenced popt config → poptConfigFileToString → realloc/strcat overflow → heap metadata corruption (reporter).

Earliest affected is `popt-1_11-release` tag in git. `poptConfigFileToString()` must be explicitly called in order for this to be reachable, which is not used by the internal source.

src/poptparse.c:191-224