[*] ioc_svlen=4, sa_len=255 (OOB read of 251 bytes)
[*] SMBIOC_OPENSESSION ...
[*] ioctl returned rc=-1 errno=22 (Invalid argument)
[+] EINVAL on bad sa_len -> sa_len IS validated (FIXED kernel)
EXIT=0
=== guest still up ===
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)