Null pointer dereference

The ucodeioctl function in intel/io/ucodedrv.c in Sun Solaris 10 and OpenSolaris snv69 through snv133, when running on x86 architectures, allows local users to cause a denial of service panic via a request with a 0 size value to the UCODEGETVERSION IOCTL, which triggers a NULL pointer dereference...