Memory corruption

The ktimer feature sys/kern/kerntime.c in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel memory via an out-of-bounds timer value...