"you'd need to patch the vulnerability" - I'm asking how. How would such a patch function? It's unclear to me how software can identify whether or not witness data contains spammy NFTs. I'm very confused about that.