Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

A remote attacker who controls a DNS zone can craft an NXDOMAIN response where the NS record name (a compression pointer) extends to the packet boundary. When dnsmasq's `find_soa()` processes this response, `extract_name()` is called with `extrabytes=0`, which only checks that the name fits within the packet but does not verify that 10 additional bytes exist for the fixed-length fields. The `GETSHORT`/`GETLONG` macros then unconditionally read 10 bytes past the valid packet boundary, causing a heap out-of-bounds read [ref_id=1].

The vulnerability resides in `find_soa()` in `src/rfc1035.c`. The function calls `extract_name()` with `extrabytes=0` when parsing NS section records, which only validates that the DNS name fits within the packet but does not verify that 10 additional bytes exist for the fixed-length fields (type, class, TTL, rdlen). The subsequent `GETSHORT`/`GETLONG` macros then unconditionally read 10 bytes past the valid packet boundary [ref_id=1].

The upstream fix at commit `14094e88beca519c53151184cc4553656672b54f` addresses the missing validation by ensuring that `extract_name()` is called with the correct `extrabytes` value so that the 10 fixed-length bytes are accounted for before the packet boundary check. This prevents the `GETSHORT`/`GETLONG` macros from reading beyond the valid packet data. The fix is included in dnsmasq 2.93rc1 [ref_id=1].