Stack-data disclosure via unchecked authentication length

Use of uninitialized memory in GitHub Trilogy before 2.1.1 allows remote attackers to read up to 12 bytes of client stack data. The trilogy_parse_handshake_packet function accepts server-supplied auth_data_len values other than the required 21 bytes, leaving part of the handshake scramble uninitialized before later authentication processing returns stack contents. Exploitation requires the client to connect to an attacker-controlled MySQL-compatible server, and the reported consequence is disclosure of at most 12 stack bytes.