CVE-2026-71256: nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic() / recvreaddeviceidentificationres() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied objectid field (0-255, read directly from the wire) is used without any bounds check as bufindex = order[objectid]. When a malicious Modbus server sends a Read Device Identification response with objectid >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.