Unintended file moves via freed path buffer

Use-after-free in fs/vfs/fs_rename in Apache NuttX RTOS 7.20 through 12.10.x allows attackers with VFS write access to misdirect moves. The recursive directory-move logic reuses one heap buffer through two pointers; resizing it frees the allocation before another pointer writes the destination path. Reachability requires attacker-controlled rename or move requests through a write-enabled VFS service such as FTP, and successful exploitation can relocate files or directories to unintended paths.