Process crash via truncated constructor entry read

Out-of-bounds read in radare2 5.8.9 and earlier allows remote attackers to crash the process with a crafted XNU kernelcache. In process_constructors, a loop advances through the constructor section in eight-byte steps while checking only that the current offset is below the section size, so a trailing partial entry reaches K_RPTR and is read past the heap buffer. Exploitation requires radare2 or rabin2 to parse the attacker-supplied file; the demonstrated consequence is termination of that analysis process.