Input-data disclosure via unchecked return-data length

Out-of-bounds reads in Vyper 0.3.10 and earlier allow attackers to read input-buffer data via malformed external-contract returns. External-call code generation overlaps the return buffer at byte 0 with the input buffer at byte 28, then checks only the dynamic type's minimum size rather than its encoded length. Exploitation requires a called contract to return invalid ABIv2 data; the caller then consumes stale argument bytes as return data, without code execution or state modification.