Heap out-of-bounds read in libnfs NFSv4 GETATTR fattr4 decode

A heap out-of-bounds read in the NFSv4 GETATTR fattr4 decoder, reachable from a malicious NFSv4 server via nfs_parse_attributes() (lib/nfs_v4.c:485, ~6 call sites).

In the Owner and Group blocks the code advances the buffer by the server-controlled string length (buf += slen) but decrements the remaining budget only by the padding (len -= pad), never by slen. After both blocks, len over-reports the true remaining bytes by slen_owner + slen_group, so the trailing rdev/space/atime/ctime/mtime reads pass CHECK_GETATTR_BUF_SPACE against the inflated budget while buf has already run past the blob.

A 116-byte PoC crashes at the first trailing read nfs_v4.c:577 (specdata4_to_rdev). Fix: add len -= slen after each buf += slen in both blocks. Same maintainer as libsmb2/libiscsi — intended to bundle. ASan-confirmed with a verified fix; disclosure pending.