Root code execution via retained chroot session

Privilege escalation in FreeBSD ftpd allows remote authenticated users with chrooted FTP accounts to execute arbitrary code as root. After chroot succeeds but chdir fails, ftpd keeps the connection open, so later authentication reads an attacker-supplied etc/spwd.db inside the jailed home as the system password database. Exploitation requires a non-anonymous login, ftpchroot configuration, an uploaded password database, and permission changes that force chdir to fail.