Imagine you have a mechanical turnstile counter at a stadium gate — the kind with physical digit wheels. It counts up to 32,767 and there's no 'full' sign. If you send enough people through, the counter rolls past its maximum, flips to a negative number, and the gate logic — which checks 'are there still people inside?' — now thinks the stadium is empty. It unlocks the maintenance doors. That's the core mechanism here: a 16-bit signed counter for shared memory attachments, present in BSD since approximately 1988, that wraps negative when you fork enough processes with shared memory attached. The committed claim: by combining this integer overflow with a race condition and a separate out-of-bounds write, Calif achieved local privilege escalation to root on a fully hardened OpenBSD system — KARL kernel relinking, SMAP, SMEP all enabled — without needing an information disclosure vulnerability. That last detail matters. Modern exploit mitigations assume attackers need to leak kernel addresses first; this chain sidesteps that assumption entirely by exploiting deterministic boot-time allocator behavior. The exploit chain is a masterclass in primitive composition. Step one wraps the shmnattch counter by mapping 127 SysV shared memory segments, unmapping them, and forking 259 processes to push the signed short to -32,643. Step two uses sysctl(KERNMALLOCSTATS) — specifically kbtotal and kbtotalfree — for heap grooming, tracking when new pages are allocated. Step three wins a race between IPCRMID in one process and a size-confused shared memory attachment in another, producing a use-after-free. Step four places a 16-byte struct ipmoptions via IP socket allocation with IPMULTICASTTTL set to 2, positioning two packed 16-bit counters (imonummemberships and imomaxmemberships) for corruption. The conditional -1 out-of-bounds write overwrites both fields, and closing the socket traverses group members, triggering atomic decrements that flip the PTE self-referential mapping from user to supervisor mode — bypassing SMAP/SMEP and achieving kernel code execution through a predictable kernel pointer. The integrity of this work is unusually high for offensive security research. Calif reported the vulnerabilities to OpenBSD with suggested patches before publication. The issues were addressed in errata 026 and 018. A proof-of-concept and code are publicly available. The exploit targets specific, named kernel structures (lo0 and enc0 ioctl handlers) and explains exactly why they're predictable: OpenBSD's KARL randomizes function and data addresses in the kernel binary, but the boot-time allocator and best-fit allocator lack base address randomization, so early allocations land at the same addresses across boots on identical hardware. The mitigation analysis is where the real value lives. Five distinct hardening approaches are proposed, each targeting a different link in the exploit chain: safe-unlinking for doubly linked lists (already implemented in FreeBSD and NetBSD), randomization of the self-referential PTE map allocation address across a 128-slot range yielding bases from 0xffffa00000000000 through 0xffffdf8000000000, kernel allocator base address randomization at boot time plus runtime allocation order randomization, compiler-level array bounds sanitization (a UBSan subset) for release builds, and the upcoming Alloc Tokens compiler feature for isolating pointer-containing allocations from non-pointer allocations. Calif privately reported 21 issues to FreeBSD that the array bounds sanitizer would have caught, some with local privilege escalation impact. The broader signal is about the economics of exploit mitigations in the AI era. Each proposed hardening doesn't just fix this bug — it eliminates or raises the cost of entire exploit primitive classes. Safe-unlinking kills the TAILQREMOVE write primitive generically. PTE map randomization kills the predictable atomic-decrement target. Allocator randomization kills the predictable-pointer assumption. The paper explicitly frames this as a cost-imposition strategy: make attackers need more vulnerabilities, more time, and more novel techniques. With AI-assisted vulnerability discovery lowering the cost of finding bugs, the defensive calculus shifts toward eliminating entire categories of exploitation rather than patching individual instances. This is responsible disclosure done at the highest level — not just 'here's a bug and a patch,' but 'here are five systemic improvements that would make this entire class of attack uneconomical.' The 37-year provenance of the vulnerable counter is a reminder that signed integer types in security-critical counters are a gift that keeps giving to attackers, and that kernel hardening is a race with no finish line.
