cursor-accumulator 1 OpenConnect Fortinet: server-induced chosen-offset stack write via snprintf-return-value cursor arithmetic Jul 7, 2026