Local buffer overflow via unchecked negative size

Buffer overflow in Zephyr RTOS IPM drivers through 3.4 allows local users to cause service interruption or execute code via crafted negative sizes. The imx_mu_ipm_send and mcux_mailbox_ipm_send functions only reject sizes above a maximum, then pass negative size values to memcpy, which converts them to large unsigned lengths and overruns stack buffers. Exploitation requires low-privilege code able to call the IPM send path across a security boundary; the vendor reports possible denial of service or arbitrary code execution and no live reproduction.