CVE-2026-42010: server RSA-PSK key exchange truncates the binary PSK
identity at the first NUL byte when looking up the pre-shared key,
causing usernames containing embedded NUL bytes to match shorter
legitimate identities and allowing authentication bypass