Tristan reports:

pdb_smbpasswd strlen Underflow Causes Out-of-Bounds Array Access
================================================================
CVSS 3.1: 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-191 (Integer Underflow) leading to CWE-787 (Out-of-Bounds Write)
Auth: Local (access to smbpasswd file)
Version: Samba 4.24.3, master HEAD

File: source3/passdb/pdb_smbpasswd.c, mod_smbfilepwd_entry(), line 826

Root Cause:

When fgets() returns an empty string (first character is null terminator,
possible when the file contains a NUL byte at line start), strlen()
returns 0. The subsequent access linebuf[linebuf_len - 1] becomes
linebuf[SIZE_MAX] due to size_t underflow, reading far past the stack
buffer.

    linebuf_len = strlen(linebuf);           // returns 0
    if (linebuf[linebuf_len - 1] != '\n') {  // linebuf[SIZE_MAX] - OOB
        ...
    } else {
        linebuf[linebuf_len - 1] = '\0';    // linebuf[SIZE_MAX] = '\0' - OOB write
    }

Data Flow:

  smbpasswd file contains NUL byte at start of a line
  -> fgets returns string starting with '\0'
  -> strlen returns 0, linebuf_len = 0
  -> linebuf[(size_t)0 - 1] = linebuf[SIZE_MAX]
  -> reads stack memory at ~18 exabytes past buffer
  -> SIGSEGV, or if comparison matches '\n': OOB write of '\0'

Impact:

A maliciously crafted smbpasswd file crashes smbd during password
modification. The most likely outcome is a crash (DoS), but the
potential OOB write of a null byte at a massive offset makes this a
memory corruption primitive if the read lands in mapped memory.

Lab verified: code trace confirmed underflow with size_t arithmetic.