When cloning an wlan interface with e.g
        ifconfig wlan0 create wlandev ath0
a struct ifnet is allocated via if_alloc and then passed to
ether_ifattach_bpf() which writes beyond the struct ifnet.
This is especially a problem if struct ifnet size is close to a chunk
size of the slab allocator - as it happens with the recent pf update.
This was catched by guards I added to the slab allocator.

Cheers,
Johannes


Reply via email to