A parser bug in a decades-old proxy path shows how legacy C code can keep leaking risk long after the original mistake was made.