CVE-2026-92449: Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

gxbinrespixelmaptableload() in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.

The overflowed buffer is allocated by GUIX itself, through gxsystemmemoryallocator, rather than supplied by the caller, so the loader corrupts its own arena. The public API gxbinresthemeload() takes no size parameter, so no amount of caller diligence prevents this.

Reproduces in the shipped default configuration; GXBINARYRESOURCESUPPORT is enabled by default.