kstrndup() reads one byte past the maxlen-bounded source when no NUL is present

Summary

When str[0..maxlen-1] contains no NUL, zlen = strnlen(str,maxlen)+1 == maxlen+1 and bcopy(str, nstr, zlen) reads str[maxlen] — one byte beyond the region strnlen validated. The stray byte is immediately overwritten by nstr[zlen-1]='\0', so nothing escapes; worst case is a kernel page fault if str+maxlen lands exactly at an unmapped-page boundary. Only three in-tree callers, all in autofs with kernel-internal name components under root-configured automounts.

Recommended fix

-   bcopy(str, nstr, zlen);
+   bcopy(str, nstr, zlen - 1); /* never read str[maxlen] */
    nstr[zlen - 1] = '\0';

Timeline

• 2026-08-30 Discovered during pass-2 audit of kern_slaballoc.c (GLM 5.3).