Local privilege escalation via unchecked driver-name copy

A stack buffer overflow in illumos-gate before 676abcb allows local users to gain kernel privileges through stat on a long /dev/net name. The ddi_parse function uses the attacker-controlled driver-name length as the strlcpy size, allowing a long device name to overrun the caller's fixed stack buffer. Any unprivileged user in a global or non-global zone can trigger the overflow; stack canaries generally convert it to a kernel crash, while exploitation can yield arbitrary kernel code execution when an information leak is also available.