panic: kmem_slab_alloc(): kernel_map ran out of space!
cpuid = 0
Trace beginning at frame 0xfffff801182ff678
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
_kmalloc() at _kmalloc+0x5be 0xffffffff8065737e
_prop_object_copyin.isra.0() at _prop_object_copyin.isra.0+0x35 0xffffffff809dfe55
sys_vquotactl() at sys_vquotactl+0x50 0xffffffff806fd750
sys_xsyscall() at sys_xsyscall+0x89 0xffffffff80bd7039
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Trigger: unprivileged user (maxx, uid 1001) issuing syscall 530 (vquotactl)
# with an invalid pref pointer (0x1), on a kernel with vfs.quota_enabled=1.
# sys_vquotactl (vfs_quota.c:345) does error=copyin(vqa->pref,...) then
# overwrites error with prop_dictionary_copyin (line 346) WITHOUT checking the
# copyin result. The uninitialized/garbage struct plistref is passed to
# _prop_object_copyin, which interprets it as a serialized object and drives
# _kmalloc until kernel_map is exhausted -> panic.