nfs_getauth()/nfs_savenickauth() take NFSKERBKEY_T (u_char[2]) as a parameter but bcopy sizeof(NFSKERBKEY_T) == 8 bytes into/out of 2-byte struct members — padding-absorbed today, latent overflow on any layout change

Summary

NFSKERBKEY_T is typedef u_char[2] (rpcv2.h:133). Both functions declare it as a by-value array parameter - decays to u_char* - then use sizeof(NFSKERBKEY_T), which inside the function is the pointer size (8 on x86_64), not 2. nfs_getauth:1075 bcopy's 8 bytes from nmp->nm_key (2-byte member, 6-byte in-struct overread) into req->r_key (absorbed by padding); nfs_savenickauth:1208 bcopy's 8 bytes into nuidp->nu_key (offset 284 of the 320-byte struct nfsuid, 6 extra bytes in allocator padding). No OOB on this platform/compiler today; becomes a real heap overflow if the struct tail shrinks, cache-line changes, or the key type widens. NFSKERB encryption #ifdef'd out so the bytes never reach the wire. Hardening. Fix: sizeof(nmp->nm_key)/sizeof(nuidp->nu_key).