This vulnerability involves a TOCTOU race condition in the illumos data-link pseudo-driver (dld) when processing DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls. The function drv_ioc_prop_common() reads the ioctl header to determine the size of a kernel heap buffer, allocates memory accordingly, and then copies the full request a second time. A concurrent thread can manipulate the size field between these operations, causing a buffer overflow that corrupts the kernel heap. An unprivileged local user, including those confined to a non-global zone with datalink ownership, can exploit this to trigger a system panic and potentially leverage the heap corruption for further compromise.

Successful exploitation allows an unprivileged local user to cause kernel heap corruption and system panic. The heap corruption may be leveraged for further privilege escalation or system compromise. The vulnerability affects system stability and security by enabling local denial of service and potential escalation of privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local user access and avoid running untrusted code in zones with datalink ownership to reduce risk.