Doc: clarify CVE-2016-9963