ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME (1025) bytes from a DHCPv6 DOMAINLIST (option 24) value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAINLIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAINLIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.