A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose only limits are the destination buffer and a NUL byte: Nothing compares "buffer_ptr" against "nx_packet_append_ptr". An ERROR packet that carries no terminating NUL, which a server controls completely, walks the loop off the end of the packet until it happens to meet a zero byte or fills the 64 byte destination. The open path has the same loop at :1327 and reports the same way. What is read lands in "nx_tftp_client_error_string", which the application is expected to display or log, so adjacent packet pool memory ends up in whatever the device does with the error text. Add "(buffer_ptr < packet_ptr -> nx_packet_append_ptr)" to the loop condition in all three paths.