tokenize() writes one pointer per token into the fixed 64-entry static token[] with no bound: kernel static-data overflow → control-flow hijack (kernel executes attacker bytes)

Summary

parse_config passes the static token[MAXTOKEN=64] to tokenize(), which executes token[tokennr]=cptr for every token with no bound check - MAXTOKEN is enforced nowhere. A VINUM_CREATE config line with >64 tokens overwrites kernel .bss with pointers into the attacker's ioctl buffer; the smashed statics include the command_fail jmp_buf, so the parse-error longjmp restores an attacker-smashed RIP. LIVE-REPRODUCED twice from fresh boots: 'Fatal trap 1: privileged instruction fault', RIP inside the kmalloc'd ioctl buffer, 'Stopped at popal' (0x61 = the token byte) - KERNEL EXECUTING ATTACKER-SUPPLIED BYTES. Quoted tokens permit NOP sleds/shellcode. Also reachable from a vinum-labelled disk (vinum read, boot autodetect). Fix validated on rebuilt kernel: PoC returns cleanly, guest stable. Root-gated via 0600 /dev/vinum/control but the crafted-disk vector makes it attacker-reachable.