The tool founds it is solvable if the user controls the initial value of a local variable (which is usually not possible)
The initial value of a local variable can be controlled if you can control the final value of a local value in a previously called function that happens to wind up at the same point on the stack, if that local variable is not explicitly initialized.
Exactly, but since this is not a possibility in the analyzed binary (the stack memory of this variable is not flagged as user-controllable), the solution can't be used to exploit it.
The initial value of a local variable can be controlled if you can control the final value of a local value in a previously called function that happens to wind up at the same point on the stack, if that local variable is not explicitly initialized.