GHSA-p3fx-9qcg-jmcf: RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply() in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULEDHCPV6CLIENTIAPD is enabled, causing parseiapdoption to read past the option body, sizet underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.