Algorithmic-complexity denial of service in musl libc GB18030 decoding

Repository is a compact proof-of-concept for CVE-2026-6042, an algorithmic complexity denial-of-service issue in musl libc's iconv implementation when decoding GB18030 4-byte sequences. It contains: (1) poc_gb18030_dos.c, a standalone local timing PoC that repeatedly feeds crafted GB18030 sequences into iconv("UTF-8", "GB18030") and measures elapsed time; (2) server.c, a minimal single-threaded HTTP server listening on port 8080 that accepts POST bodies, extracts charset from Content-Type, and transcodes request bodies to UTF-8 via iconv(), thereby simulating a realistic remotely reachable attack surface; (3) test.sh, an end-to-end harness that generates benign and adversarial payload files under /tmp and POSTs them to the server with curl while measuring wall-clock time; and (4) a Dockerfile that builds the vulnerable demo server on Alpine/musl. Main exploit capability: denial of service through CPU exhaustion, not code execution. The exploit input is a small crafted GB18030 byte sequence, especially 0x82 0x35 0x8F 0x33, repeated multiple times. The PoC demonstrates that benign sequence 0x81 0x30 0x81 0x30 decodes quickly, while adversarial sequences cause iconv() to spend disproportionate time in the GB18030 mapping logic. README and code comments also note a similar pattern in EUC-KR handling, but the implemented exploit path and test harness focus on GB18030. Network exposure is straightforward: POST requests to the demo HTTP service at / on port 8080 with Content-Type including charset=gb18030 and a crafted binary body. Successful exploitation yields delayed responses and high CPU usage; the server reports timing in the X-Transcode-Time header and response body. This is a real PoC exploit for DoS validation rather than a mere detector, but it remains proof-of-concept maturity because it demonstrates the condition rather than packaging a generalized offensive framework or customizable payload system.