static-analysis 2 OpenConnect Fortinet: server-induced chosen-offset stack write via snprintf-return-value cursor arithmetic Jul 7, 2026 Case-variant path aliases in Rust denial gates: anatomy of a canonicalize-fallback bypass Jul 7, 2026