Local buffer underflow via HOME length truncation

Numeric truncation in HOME path handling in Arun Prakash Jana nnn 5.2 allows local users to corrupt adjacent memory via a crafted HOME value. The code stores the HOME path length in the uchar_t homelen variable; a HOME path longer than 255 bytes truncates to 0, so (homelen - 1) becomes -1 after integer promotion and triggers a read and write one byte before the path buffer. Exploitation requires control over the victim process environment and reaches a one-byte underflow immediately before the buffer, with reported impact limited to the nnn process memory space.