Kernel memory corruption via AT response parsing

Out-of-bounds write in the HL7800 modem driver in Zephyr RTOS before 4.4.2 allows attackers to corrupt kernel memory via AT responses. Multiple handlers copy modem-supplied fields into 128-byte stack buffers with net_buf_linearize() and then append a NUL at value[out_len], so an exact-length field writes one byte past the buffer; the +KCELLMEAS handler is worse because it uses the unbounded wire length as the destination size and can overflow the stack buffer outright. Exploitation requires control of modem-emitted response lines, such as through a rogue base station, compromised baseband, or injected serial framing, and can cause a crash or, on the +KCELLMEAS path, possible kernel-context code execution.