Local privilege escalation via unterminated nvlist string

Out-of-bounds write in FreeBSD libnv allows local users to escalate privileges or panic affected systems via a packed string array. The nvpair_unpack_string_array routine fails to verify that the final serialized string ends with a null byte before processing it, permitting access beyond the supplied buffer. A local malicious process must submit a crafted packed nvlist through a libnv consumer; the overwrite can affect userland or kernel memory.