When setting font with malicous data by ioctl cmd PIO_FONTkernel will write memory out of bounds.

...