Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer (CVE-2026-10644) | HOL Guard CVE