Code execution via deletedir remain underflow

Stack-based buffer overflow in afpd in Netatalk before 4.4.3 allows remote authenticated users to execute code via crafted AFP filenames. In deletedir(), the remaining-space calculation for a stack path buffer underflows a size_t remain value to SIZE_MAX, so the subsequent bound check passes and strcpy() copies an attacker-controlled filename into an almost full stack buffer. Reachability requires authenticated AFP access and a cross-device directory operation inside a shared volume; successful exploitation can corrupt or crash the afpd child process and can yield code execution in that service context.