Ping. This is a stack buffer overflow in M-mode reachable from S-mode or U-mode on any hart with VLEN > 128, which covers most vector-capable hardware shipping today. The fix is a unit conversion at two call sites. Happy to rework it if there's a preferred approach. Thanks, Sebastian