A flaw was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is used as a loop count in savemeta.c and metawalk.c without bounds validation. The ea_num_ptrs field is a __u8 (max 255). Each iteration reads a pointer (8 bytes) plus name data. With ea_num_ptrs=255 and a 512-byte block buffer, the loop reads up to 1384 bytes past the buffer boundary, causing a heap out-of-bounds read. This may disclose sensitive heap memory contents through tool output or error messages, and the significant over-read (2.7x the allocation) has a non-trivial probability of crossing a page boundary into unmapped memory, causing a crash.