Scope Is Support Status

The CVE's affected-versions line is the vendor's end-of-support matrix, not a code boundary. The bug class and the fix exist across the branches both inside and outside that matrix; the record encodes the vendor's business decision as if it were a property of the code.