Trimble GSOF nested record parser lacks bounds checks before fixed-offset reads

**Severity:** high • **Confidence:** high • **Category:** Peripheral or protocol parser memory safety **Finding ID:** DSS-CANON-001 **Affected lines:** entrypoint/wrapper libraries/AP_GPS/AP_GPS_GSOF.cpp:124-136; closest_control libraries/AP_GSOF/AP_GSOF.cpp:87-102; sink libraries/AP_GSOF/AP_GSOF.cpp:199-223; sink libraries/AP_GSOF/AP_GSOF.cpp:251-259; storage_layout libraries/AP_GSOF/AP_GSOF.h:19,231-232; GPS serial source libraries/AP_GPS/AP_GPS_GSOF.cpp:123-136; Packet buffer fill libraries/AP_GSOF/AP_GSOF.cpp:26-61; Packet buffer declaration libraries/AP_GSOF/AP_GSOF.h:229-235 Trimble GSOF nested record parser lacks bounds checks before fixed-offset reads survived centralized static validation. The current controls are insufficient at entrypoint/wrapper libraries/AP_GPS/AP_GPS_GSOF.cpp:124-136; closest_control libraries/AP_GSOF/AP_GSOF.cpp:87-102; sink libraries/AP_GSOF/AP_GSOF.cpp:199-223. **Remediation:** Validate packet, field, count, and string lengths before fixed-offset reads/writes; add parser tests for short, oversized, unterminated, and malformed frames. Full details: https://firmware.ardupilot.org/AI_scan/codex_scan_2026_06_07/7851f731a9c_20260606T170156+1000/report.html#1-trimble-gsof-nested-record-parser-lacks-bounds-checks-before-fixed-offset-reads PR: https://github.com/ArduPilot/ardupilot/pull/33436