Client denial of service via bitmap length underflow

Integer underflow in FreeRDP before 3.24.0 allows remote attackers to interrupt a client via a crafted compressed bitmap order. In update_read_cache_bitmap_order, an unsigned network length below eight is decremented by eight before validation, wrapping to a huge value used for allocation and stream reading. Exploitation requires a client to connect to an attacker-controlled RDP server and results in memory exhaustion or process termination, not data access or modification.