Summary

i_setopt copies user-supplied headerDigest/dataDigest strings into 6-byte stack buffers using copyinstr with maxlen=6 then gates on return!=EFAULT instead of ==0. String CRC32C is exactly 6 chars (7 with NUL) so user supplying the only meaningful digest name causes copyinstr to return ENAMETOOLONG with buffer filled but NOT NUL-terminated (copyio.c:273-303). Guard != EFAULT admits ENAMETOOLONG; strcmp(hdigest CRC32C) reads past hdigest[5] looking for NUL = kernel-stack OOB read bounded only by next NUL on stack reads len/ddigest/saved registers. Local root dev node 0600. Feature also broken: user can never enable CRC32C through valid string.