Adjacent-network code execution via SPF macro underflow

Integer underflow in Exim LibSPF2 allows remote attackers on an adjacent network to execute code through crafted SPF macros. In SPF_c_parse_var in spf_compile.c, the parser subtracts sizeof(SPF_data_t) from an undersized available-length value without first checking the bound, so the computed capacity underflows before subsequent writes. No authentication or user interaction is required, and successful exploitation runs code as the service account; upstream correspondence leaves the linkage between the published CVE and the candidate fix unresolved.