Jail escape via cross-jail directory descriptor exchange

Jail escape in FreeBSD allows local users controlling two cooperating jails to gain full access to the host filesystem. A jailed process accepts a directory descriptor exchanged over a Unix domain socket from a sibling jail, and pathname lookup continues when it never encounters the recipient jail root. Exploitation requires two controlled jails sharing a nullfs mount where a Unix socket can be installed; escape permits reading and writing files outside the jail.