Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in the ReceivedPacketCache::enqueuePacket() function. Unauthenticated remote attackers can exploit this by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without any bounds checking. This causes the server to allocate one CacheItem per missing packet ID gap, rapidly exhausting available host memory. The vulnerability ultimately propagates an uncaught std::bad_alloc exception to std::terminate(), crashing the server process. The fix was introduced in commit 2492d18 of the Sonic 3 A.I.R. GitHub repository. No authentication is required to trigger this denial-of-service condition, making it remotely exploitable by any attacker.