wsdd2 has two remotely reachable memory-safety bugs, one in each packet
parser. Both are present in 1.8.7 verbatim.

1. NULL-pointer write, remote DoS. wsd_parse_http_header() does
   *eol = '\0' on the result of strstr(buf, "\r\n") with no NULL check.
   A TCP segment to port 3702 beginning "POST " with no CRLF crashes the
   daemon. It is single-threaded, so one unauthenticated packet ends
   discovery for every host it advertises. Confirmed on hardware.

2. Out-of-bounds read. llmnr_send_response() walks the DNS question
   labels and reads QTYPE/QCLASS without bounding the cursor against the
   received length, so a crafted LLMNR query reads past the packet.

Both found with libFuzzer under ASan/UBSan. Minimal fixes attached
(wsdd2-01-http-null-deref.patch, wsdd2-02-llmnr-oob-read.patch).

Note: upstream github.com/Netgear/wsdd2 and the fork the d/watch tracks
(github.com/Andy2244/wsdd2) are both gone; github.com/oldium/wsdd2 is the
only surviving tree and has these fixes. The package will need to carry
them as debian/patches regardless.