David Holland <dholland+netbsd@eecs.harvard.edu> wrote:
> There are, unfortunately, two problems with what you've got: (1) you
> haven't validated the whole block, only the first byte, so copyout can
> still fail... and (2) even if you do validate the whole block in
> advance, the copyout call can still fail if another thread has
> rearranged the memory map in the meantime.

As I wrote in the source:
	/*
	 * Copy the data to the user-space.  In this stage user can falsify
	 * the pointers, but it would be a violation, thus the result will
	 * not be checked, and memory will be freed.
	 */
The intention is to check for invalid pointers, not violations. I am not sure
if it is worth checking (1) point.

-- 
Best regards,
Mindaugas
www.NetBSD.org