Summary

Kernel port computes user_mem=mem+alloc_sz (alloc_sz=req_sz) derives hdr=(user_mem-sizeof(*hdr)) tail=(user_mem+alloc_sz) allocates only alloc_sz<<2 bytes (safe_mem.c:80-84). Diverges from correct userland original (lib/libtcplay/safe_mem.c:62,78-80 which uses alloc_sz=req_sz+sizeof(*hdr)+sizeof(*tail) hdr=mem user_mem=mem+sizeof(*hdr)). For req_sz < sizeof(struct safe_mem_hdr)~56 bytes header pointer lands BEFORE start of kmalloc so stores to hdr->sig/prev/next/tail/file/line/alloc_sz (86-91) write into preceding heap object. For req_sz >= SIZE_MAX/4 alloc_sz<<2 wraps to tiny value kmalloc returns small buffer but user_mem=mem+req_sz is wild pointer header/tail stores corrupt unrelated kernel memory. Both directions unconditional kernel heap corruption. Attacker: any code calling alloc_testcase_mem(x) with attacker-influenced x. In-tree callers tbridge testcase modules root-only via kldload /dev/tbridge 0600 root:wheel. TBRIDGE_LOADTEST ioctl accepts proplib dict. Impact deterministic heap corruption convertible to arbitrary kernel read/write via slab-grooming then uid=0. Opt-in module not default hence Medium.