Reported by chris@mode51.software in the mailing list: _When nrUE invokes _[_decode_registration_accept_](https://gitlab.eurecom.fr/oai/openairinterface5g/-/blob/develop/openair3/NAS/NR_UE/5GS/5GMM/MSG/RegistrationAccept.c?ref_type=heads#L115)_ the logic that _[_decodes the optional IEs_](https://gitlab.eurecom.fr/oai/openairinterface5g/-/blob/develop/openair3/NAS/NR_UE/5GS/5GMM/MSG/RegistrationAccept.c?ref_type=heads#L140)_ crashes when used with a commercial gNB._ _The last IE in the Registration Accept is NSSAI inclusion mode which is expressed as a single byte._ _The default case in the while loop in decode_registration_accept attempts to skip unsupported IEs but there are a couple of problems:_ _- in the default case for an unsupported (by nrUE) IE the second byte after the element ID is treated as the length and this is then incremented by 1. This is ok for other element IDs, where the next byte usually is the length, but not for the single byte NSSAI inclusion mode. It is also the last element so the length is actually then read from beyond the end of the buffer._  _- the while loop exits when ba.len \< 0. ba is a byte_array_t, len is a size_t, which is unsigned. The processing carries on when a malformed/unknown IE causes ba.len to have been decremented below 0._ _The loop needs a more robust bounds check and should discard malformed/unsupported IEs._