OpenBSD 7.9 Root Exploit Chains 1988 shm_nattch Integer Overflow With UAF to Defeat KARL and SMAP/SMEP

OpenBSD shipped two errata in September 2025 fixing the chain: errata 018 widened the shm_nattch counter after it wrapped from 32,767 to a negative value, and errata 026 addressed the resulting use-after-free. The integer overflow was labeled a reliability fix despite enabling the full privilege-escalation path. No CVEs were assigned. Calif's write-up shows the exploit maps 127 segments and forks 259 processes to trigger the wrap, then races the free to corrupt page-table entries via multicast counters. The 37-year persistence traces directly to OpenBSD inheriting the original BSD type definition without widening it, while KARL only randomizes the kernel binary itself. Both the boot-time and best-fit allocators leave early structures at fixed offsets, allowing the exploit to overwrite a lo0 interface function pointer without any leak primitive. This pattern matches prior allocator determinism issues reported in FreeBSD and NetBSD before they added base randomization. Calif's four hardening recommendations—safe unlinking, page-table self-map randomization, allocator base randomization, and compiler bounds checks—align with mitigations already shipping in sibling BSDs. OpenBSD 7.8 received the counter fix but remains exposed to the use-after-free component. The absence of assigned CVEs and the reliability-only classification delayed coordinated disclosure. No public evidence shows in-the-wild use. Future releases must address deterministic kernel allocators; without base randomization, similar reference-count chains will remain viable on the same hardware across reboots.