The vulnerability stems from the HopPayload.Decode function's failure to validate() the payload length before memory allocation. The blog post explicitly shows the vulnerable code pattern where payloadSize (from untrusted input) was used directly to allocate memory via make([]byte, payloadSize). The fix added a tlvPayloadSize helper that enforces a maximum size (math.MaxUint16), confirming this was the vulnerable entry point. The sphinx package context matches LND's onion processing implementation described in vulnerability reports.