> What return path could possibly lead to a RCE?
API protocol says “return value is either “OK” or “ERR””, attacker sends “Floccinaucinihilipilification”, overflowing the 3-byte response buffer allocated on the stack.
Right, so you have the first step of something, but then depending on everything else, this is either a DOS or a RCE.
I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.