1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1 fields should not have the GST_H266_MAX_SUBLAYERS limitation. 2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1 Fixes ZDI-CAN-27381, CVE-2025-6663 Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9294>