Heap buffer overflow in cmd_qtdpsrc (gdbserver/tracepoint.cc). The function allocates xmalloc(slen+1) sized by the packet's declared slen field, but calls hex2bin(packet, src, strlen(packet)/2) using the actual hex data length independently. When actual data exceeds declared slen, hex2bin overflows the heap buffer by the difference with attacker-controlled content. Demonstrated exploitation: overflow corrupts process_info_private::thread_db, replacing the td_ta_map_lwp2thr_p function pointer with an attacker-chosen address. A subsequent qGetTLSAddr packet causes gdbserver to call through the forged pointer, achieving RIP control and native code execution.