From Andy Lutomirski

The attached Python script will segfault tcsd.

This particular vulnerability is a read from an attacker-controlled address, so getting anything more severe than information disclosure out of it may be difficult. But there is a lot of fishy input validation, and it may be possible to persuade the code to write out of bounds as well. It is certainly possible to cause memory allocation failures, but I haven't seen one that's unchecked yet.

Upstream report (currently private) here: https://sourceforge.net/tracker/?func=detail&atid=704358&aid=3473554&groupid=126012