Summary

tokenize(char *cptr, char *token[]) accepts output pointer array with NO length parameter and increments write index tokennr without any bound check performing token[tokennr]=cptr once per token (vinumparser.c:175-176). Sole in-tree caller hands it static array token[MAXTOKEN=64] (vinumconfig.c:78/58) reached directly from VINUM_CREATE ioctl on /dev/vinum/control with fully user-controlled 1024-byte buffer (vinumio.h:113/116 vinumioctl.c:108 vinumconfig.c:1627). Input with more than 64 whitespace-separated tokens makes tokenize write kernel pointers past token[63] into adjacent module BSS (global tokens int ioctl_reply pointer current_drive/plex/volume ...) corrupting up to ~3.5KB for full 1024-byte input. Deterministic kernel memory corruption: reliable kernel panic (DoS) and primitive for further root->kernel escalation. Also Consequence B: 1024-byte input with no NUL/newline/# anywhere causes non-quoted scan (line 190) to run past byte 1023 then *cptr++=NUL (line 193) writes single NUL byte past allocation. tokenize trusts both input termination and output capacity. Attacker: root via caps_priv_check(SYSCAP_RESTRICTEDROOT) on /dev/vinum/control (vinum.c:459). Single VINUM_CREATE ioctl. OOB write occurs inside tokenize before parse_config dispatches. Write values are kernel addresses into attacker 1024-byte ioctl buffer (offsets fully controlled via token widths) = controlled-count partially-controlled-value corruption primitive developable for root->kernel arbitrary write or securelevel/jail escape.