Thanks defcon for all the fun! Let’s drop a vuln I’ve been looking into during the con! There is a pre-authentication out-of-bounds write in uboot in the IPv6 receive path, reachable from a single link-local DHCPv6 ADVERTISE. net_ip6_handler() (net/net6.c:426, :442) passes the wire-supplied UDP length to the DHCPv6 client without checking it against the number of bytes actually received. The client then acts on that length: dhcp6_send_request_packet() (net/dhcpv6.c:244) copies an attacker-declared number of bytes past the net_pkt_buf transmit buffer. When the copy overruns onto the push_packet function pointer (net/net.c:1201), uboot calls it on the next received frame, which runs that frame's bytes as a command line via run_command(). The result is pre-authentication remote code execution in the bootloader! uboot MUST be compiled with CONFIG_IPV6=y and CONFIG_CMD_DHCP6=y to work confirmed and reproduced two ways:  + QEMU qemu_arm64 over virtio-net: an injected command (e.g. "echo ...") runs and prints on the console.  + Physical Raspberry Pi 4 (bcmgenet): the same ADVERTISE redirects the program counter to the planted run_command address. The Synchronous-Abort elr equals the injected value.