This vulnerability involves a time-of-check to time-of-use (TOCTOU) race condition in the illumos data-link pseudo-driver (dld) when processing DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls. The function drv_ioc_prop_common() reads the pr_valsize field from an ioctl header to allocate a kernel heap buffer, then copies the full request again from user space. A concurrent thread can increase pr_valsize between these operations, causing the second copy to write beyond the allocated buffer, corrupting kernel heap memory. An unprivileged local user, including those confined to a non-global zone owning a datalink, can exploit this to panic the system. The heap corruption may be leveraged for further compromise. The CVSS 4.0 score is 5.8 (medium severity). No patch or vendor advisory indicating remediation is currently available.

Successful exploitation allows an unprivileged local user to cause kernel heap corruption, which can lead to a system panic (denial of service). The heap corruption may also be leveraged for further privilege escalation or compromise, although no known exploits are reported in the wild. The vulnerability affects system stability and security by enabling local users to disrupt kernel memory integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict unprivileged local user access to /dev/dld and limit the ability of non-global zones to own datalinks if possible. Monitor vendor channels for updates and apply official patches once released.