Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

An attacker controlling a malicious, compromised, or spoofed Bluetooth Classic HFP Audio Gateway (AG) sends a syntactically valid but overlong `+CIND:` response during SLC setup after the HF sends `AT+CIND=?`. By including more than 20 indicator tuples, the attacker drives the parser's `index` beyond the bounds of the 20-element `ind_table[]` array. For each tuple whose name matches a known indicator in `ag_ind[]`, a small byte value (0–6) is written at the out-of-bounds offset. The attacker can first send 20 unknown-name tuples to advance `index` to 20 without writing, then send a known-name tuple (e.g., `"service"`) to write the first out-of-bounds byte, corrupting security-relevant fields and causing denial of service or protocol state corruption [ref_id=1]. No user interaction is required beyond the device connecting to the attacker's AG.

The vulnerability resides in `subsys/bluetooth/host/classic/hfp_hf.c` in the `cind_handle_values()` function. During Service Level Connection (SLC) setup, `cind_handle()` iterates over each tuple in the AG's `+CIND:` response and calls `cind_handle_values()` with an incrementing `index` without verifying that `index` is less than `HF_MAX_AG_INDICATORS` (20). The write `hf->ind_table[index] = i` can therefore write past the 20-element `int8_t ind_table[]` array, corrupting adjacent struct fields such as `hf_ind`, `ag_ind`, `ind_enable`, `ag_sdp_version`, and `ag_sdp_features` [ref_id=1].

The patch adds a bounds check at the top of `cind_handle_values()`: `if (index >= ARRAY_SIZE(hf->ind_table))` followed by a warning log and an early return [patch_id=6467006]. This mirrors the existing bounds check already present in the sibling consumer handler `ag_indicator_handle_values()`, confirming the omission was unintentional [ref_id=1]. With this guard, any `+CIND:` response containing more than 20 indicator tuples will cause the parser to silently skip the out-of-bounds entries instead of writing past the array, preventing memory corruption.