An issue exists in the EROFS (Enhanced Read-Only File System) implementation where out-of-bounds handling occurs for trailing directory entries. While boundary checks for `nameoff` are present, trailing entries are processed using `strnlen()` with unchecked `nameoff` values. A specially crafted EROFS image containing a trailing directory entry with a `nameoff` greater than or equal to `maxsize` can cause an underflow in the calculation of `maxsize - nameoff`, leading `strnlen()` to read beyond the directory block. Additionally, `nameoff0` must be verified as a multiple of `sizeof(struct erofs dirent)`.