fix: remove unsafe exec() in call_qcsapi.c

[orbisai0security]

Summary

Fix critical severity security issue in package/firmware/quantenna/src/call_qcsapi.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	package/firmware/quantenna/src/call_qcsapi.c:9681
CWE	CWE-120

Description: Two unbounded strcpy() calls at lines 9681 and 9715 copy argv[0] directly into a fixed-size mac_addr buffer (typically 18 bytes for MAC format XX:XX:XX:XX:XX:XX) without any length validation. An attacker supplying a string longer than the destination buffer will overflow the stack frame, overwriting the saved return address and enabling arbitrary code execution. This is a textbook stack buffer overflow with no mitigating controls evident in the code.

Changes

• package/firmware/quantenna/src/call_qcsapi.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security