CVE-2026-95107: Module object allocation size overflow corrupts the manager object pool

A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.