Stack buffer overflow in remote_target::fetch_register_using_p (gdb/remote.c). The function allocates a stack buffer via alloca(register_size) then decodes the stub's p-reply into it with a loop that terminates only on NUL, without bounding writes by register_size. A malicious RSP stub sends an oversized p-reply to overflow the stack buffer and overwrite the saved return address. The same primitive — with a reply shorter than register_size — leaks stack bytes via raw_supply, enabling canary and ASLR disclosure from the same connection.