CVE-2026-49430

In the ZFS_IOC_RECV_NEW heal path, OpenZFS truncates a 64-bit payload size to 32-bit for allocation but uses the original 64-bit size as the byteswap length, causing a heap overflow exploitable by any local user with the "receive" delegated permission. Fixed in FreeBSD 14.3/14.4/15.0/15.1 release...