Turns out the CVE-2022-39377 fix included in 12.7.1 and 12.6.2 was not complete.
arm done
amd64 done
ppc done
ppc64 done
sparc done
arm64 done
x86 done all arches done