Stack buffer overflow in parse_tracepoint_definition (gdb/tracepoint.c), Z branch. The packet buffer rs->buf is reused between requests without clearing. When a short qTsP reply follows a longer qTfP reply, the parser's p pointer — advanced through strchr/unpack_varlen_hex calls — walks past the short reply's NUL terminator into stale data from the prior longer reply. hex2bin then copies strlen(p)/2 pairs into an alloca buffer sized only for the short reply, overflowing it. Fires automatically during target remote connection setup with no additional user commands.