Service interruption via field-spanning cursor bitmap copy

An out-of-bounds write in Linux vboxvideo allows local users to interrupt service by updating a virtual cursor shape. The hgsmi_update_pointer_shape function copies a variable-length cursor bitmap through p->data, which is declared as a four-byte array even though trailing storage is allocated. The field-spanning copy triggers hardened memcpy checks; exploitation requires low-privileged local access to the VirtualBox cursor update path and affects availability only.