A vulnerability was found in the BusyBox DHCP client (networking/udhcp/dhcpc.c), specifically in d4recvrawpacket(). The function trusts the attacker-controlled IP totlen field to calculate the payload size. When a malicious DHCP packet is sent with IP totlen set to 20, the subtraction underflows to a negative value, wraps to a massive unsigned value, and is passed to memcpy(), causing an immediate segfault.

Remote code execution is not practical because the oversized memcpy faults immediately. The attack requires Layer 2 network adjacency.