Memory overwrite via packed-size integer overflow

Integer overflow in libnv in FreeBSD allows attackers to overwrite userland or kernel memory via a malicious packed nvlist. The unpacking logic uses an attacker-controlled size in buffer-allocation arithmetic without first rejecting integer overflow, so the allocated buffer can be smaller than the parsed data. Exploitation requires a kernel or userland consumer that accepts the crafted packed nvlist and can grant privilege escalation or trigger a system panic.