Esme Povirk (@madewokherd) commented about dlls/sane.ds/ui.c:
} control_len += len + padding;
optionsExist[cntOptionsExist] = opt.optno;
`optionsExist` is not bounds-checked.
`cntOptionsExist` is never reset to 0 if `create_options_page` is called multiple times.