smb PathConsumed OOB

Vulnerability analysis

When the SMB client processes a DFS referral response from a server, a PathConsumed field in the response is used to advance through the search path during DFS path parsing without being checked against the actual length of the search name. A malformed response with a PathConsumed value larger than the search name causes later parsing to read past the end of the allocated path buffer, resulting in an unbounded out-of-bounds read. The fix validates PathConsumed against the search name length (in both Unicode and non-Unicode modes) before storing it, rejecting any response where the value exceeds the valid range. This is reachable by any SMB client that connects to a malicious or compromised server, or by a network attacker who can intercept SMB traffic; no privileges on the client are required.