Calif's Oct 16 'Big Fish' writeup says the SysV shared-memory attach counter has been a signed 16-bit short since the original BSD sources. Forking enough processes wraps it negative, which with a race gives a kernel use-after-free; combined with a separate conditional out-of-bounds write it yields root with KARL, SMAP and SMEP on and no info leak. Calif says the issues were fixed in OpenBSD 7.9 errata 026 (Sep 30, kernel reference-counting use-after-free) and 018 (Sep 14, integer overflow in shmat). Local privilege escalation only; there are no reports of in-the-wild use. Run syspatch if you haven't since September.