CVE-2026-71254: nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator responsedatasize is declared as uint8t and is incremented by 2 + recordlength2 for each of up to 35 sub-requests; with 35 sub-requests of recordlength=124, the cumulative demand is 8750 bytes, which overflows the uint8t accumulator. A subsequent loop then calls getn(), an internal function with no bounds checking, once per sub-request to obtain a pointer into the 260-byte msg.buf receive buffer and advances the internal bufidx by up to 248 bytes per call; swapregs() then writes to that pointer unconditionally. A single crafted FC 0x14 request from an unauthenticated network client can cause up to ~8490 bytes to be written out of bounds past the 260-byte buffer, corrupting adjacent memory in the server process and leading to denial of service or potential remote code execution, particularly on embedded/bare-metal targets without memory protection.