GHSA-x442-m7cc-hr92: kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy

When inner CPI instructions use instruction types not recognized by Kora’s parser (including Token-2022 extension instructions like ConfidentialTransfer, TransferFeeExtension::WithdrawWithheldTokens, etc.), they are reconstructed as stub instructions with empty accounts and empty data. These stubs fail deserialization during fee payer policy validation and are silently skipped, meaning any fee payer usage within those instructions goes completely unchecked.