fix: remove unsafe exec() in module.c

[orbisai0security]

Summary

Fix critical severity security issue in mupen64plus-rsp-cxd4/module.c.

Vulnerability

Field	Value
ID	V-011
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-011
File	mupen64plus-rsp-cxd4/module.c:294
CWE	CWE-120

Description: Multiple confirmed memory safety vulnerabilities in the RSP plugin and game controller subsystem combine into a realistic attack chain. A crafted N64 ROM can trigger: (1) a stack buffer overflow via sprintf/strcpy in module.c:294-298, (2) out-of-bounds writes in game_controller.c:64/77 via malformed SI commands, and (3) heap corruption via double-free/mismatched allocator in module.c:390-396 on Windows. Any one of these paths can be used to corrupt memory and construct a code execution exploit. The attacker only needs to convince a user to open a malicious ROM file — no authentication, network access, or elevated privileges are required.

Changes

• mupen64plus-rsp-cxd4/module.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security