A flaw was found in BusyBox's udhcpc6. The requested_ipv6 pointer references a heap copy of the IA_NA option that is freed on every Reply before the new one is validated, and again in send_d6_discover() just before the pointer is read. A malicious DHCPv6 server on the link can trigger this use-after-free with a Reply lacking a usable IA_NA or IA_PD, causing a 16-byte stale heap read; the stale value, typically the previously assigned address, is then sent in the next Discover. Under hardened allocators this may cause the client to crash.