CVE-2026-92389: TFTP direction confusion

curl's TFTP state machine accepts either direction's opening response regardless of which one was requested. A malicious TFTP server can answer an RRQ with ACK block 0, which flips curl into transmit mode and causes it to drain whatever read source the handle's sticky `CURLOPT_READDATA` points at, …

// lib/tftp.c:766-781
case TFTP_EVENT_ACK: /* only valid reply to WRQ — no upload check */
  result = tftp_connect_for_tx(state, event);
  break;

case TFTP_EVENT_DATA: /* only valid reply to RRQ — no upload check */
  result = tftp_connect_for_rx(state, event);
  break;