Length validation flaw in gdb_parse_agent_expr (gdbserver/ax.cc). The function trusts the attacker-declared xlen unconditionally: xmalloc(xlen) allocates the buffer and aexpr->length is set to xlen, but hex2bin stops at the packet terminator if actual data is shorter, leaving the buffer tail uninitialized. Additionally, *actparm is advanced by xlen*2 regardless of actual data length, producing a wild pointer the caller dereferences. Two confirmed impacts: (1) gdbserver echoes uninitialized heap bytes back to the client, disclosing heap addresses for ASLR bypass; (2) deterministic crash via wild pointer when declared length greatly exceeds actual data.