Serial protocol parsers need to treat device-provided lengths and counts as untrusted input to avoid invalid access or corrupted state.
Review the proposed parser bound, regression coverage and affected firmware versions. A pull request alone does not establish a released vulnerability or exploitation.