A kernel Use-After-Free vulnerability exists in the function ctl_write_buffer due to incorrect flag setting when a command finishes processing. This flaw can be exploited by malicious software running in a guest VM exposing virtio_scsi to achieve code execution on the host within the bhyve userspace process, which runs with root privileges but is sandboxed by Capsicum. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.