A flaw was found in libslirp. The NC-SI OEM response handler (ncsi_rsp_handler_oem() in src/ncsi.c) reads and reflects the 4-byte mfr_id field from the incoming NC-SI OEM command packet into the outgoing response before validating that the packet is large enough to contain that field. ncsi_input() only validates pkt_len against the 16-byte NC-SI common header (the fix scope of CVE-2020-29129), leaving the OEM sub-dispatch path, added afterward, unchecked. A guest capable of sending a crafted 30-33 byte NC-SI OEM Ethernet frame (ethertype 0x88F8) can cause up to 4 bytes of adjacent host RX-buffer memory to be disclosed back to the guest in the NC-SI response; if the instance is configured with a Mellanox manufacturer ID, a second handler (ncsi_rsp_handler_oem_mlx()) similarly over-reads up to 4 additional bytes from cmd->data. This is a guest-triggerable, bounded host memory disclosure; there is no write and no code execution.